Original title: When Does Authorization End? Effect Closure at Provider Boundaries
Igor Santos-Grueiro · September 2026
When systems cancel someone's access, they often say the job is finished before all actions actually stop. A provider can follow its rules while old, approved commands still slip through to make unwanted changes. The researchers call the complete absence of these loophole paths effect closure. To solve this, they built EFFECTBOUND. This tool checks a system's interface contracts to see if it can honestly guarantee that unwanted effects are truly blocked. It models the problem as finite control with hidden stateA simplified system representation where some information is not directly visible but can be inferred.. Looking at GitHub, Kubernetes, NATS, and Kafka, the authors found three big failure patterns: interfaces lack necessary controls, clean-looking states hide ongoing tasks, or models stop before the final point where effects can be stopped. In tests, GitHub could merge unreviewed code, NATS could publish extra messages, and Kafka could still append data after revocation. Adding a gate to Kafka successfully blocked these delayed actions.
Imagine you stop serving food at a buffet, but guests already have plates that might spill on the floor. You need to know if all plates are empty or cleared before you can say the floor is safe. In this paper, stopping service is like revoking authorization, the plates are pending work, and checking for spills is like ensuring no unwanted effects occur.
Developers and users of systems like GitHub and Kafka rely on authorization cleanup to prevent unintended actions. Without confirmed closure, security gaps and operational errors can occur even after permissions are revoked.
The abstract notes that closure fails in three ways: an interface lacks needed control, clean visible state hides active work, or the model stops before the effect frontier. EFFECTBOUND may return no verdict when evidence is insufficient, and the study is limited to specific systems like GitHub, Kubernetes, NATS, and Kafka, focusing on synchronous, nontransactional write paths in the Kafka test.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
When Does Authorization End? Effect Closure at Provider Boundaries — Igor Santos-Grueiro
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.