Preprint proposes runtime controls for resources acquired by AI agents

Researchers describe a runtime authorization system intended to stop autonomous AI agents from turning newly acquired compute, credentials, accounts or services into unauthorized authority. The preprint's architecture quarantines returned resources, resolves their capabilities from authenticated provider evidence and activates them only after checking provenance, current authorization and limits spanning identity, effects, data and delegation. In registered evaluations, the reference implementation accepted 20 benign traces and rejected 40 unsafe traces across 810 events. A staged connection between an AI tool protocol and Docker completed two benign cases, while none of 16 unsafe cases added an unauthorized container-start request. The results remain preprint findings under explicit assumptions rather than evidence from a production deployment.