The Permission Boundary

A boundary breach without a forbidden sentence

Consider two constructed worlds presented to the same principal in the same workspace under the same current policy. In both worlds, the authorized evidence states:

• status: PENDING;
• capacity index: 0.67;
• control: MANUAL.

The answer is identical. The citation is identical. The metadata and response disposition are identical. No restricted phrase appears in either answer. The only difference is a hidden review state outside the principal's authorized projection.

Yet visible confidence is 0.7764 in World A and 0.9860 in World B.

That difference is itself a public output. A principal who repeats related queries, compares confidence movement, or combines it with outside knowledge can learn about restricted state without receiving a forbidden sentence. In the selected held-out trace, the focal execution produces a separate policy-facing scalar confidence score of 0.8848. The fitted trace policy assigns 0.5775 probability of release validity and releases the case because its threshold is 0.2150. The paired-world evaluator holds information that the one-world gate cannot observe directly: the public execution changed when only restricted state changed.

This example does not claim that every confidence difference is exploitable. It establishes a more basic point:

That distinction motivates the study.

1Permission after reasoning

A conventional access check asks whether principal $p$ may perform action $a$ on object $v$ under policy state $\eta$. The check is local. It can be correct while the resulting system remains insecure.

A reasoning pipeline may:

1. retrieve authorized and unauthorized candidates into one context;
2. derive a claim from several sources;
3. suppress the restricted citation while preserving its influence;
4. expose a source title, document count, confidence value, or refusal state;
5. reuse a cache created before revocation;
6. carry context from another workspace;
7. release a conclusion whose transitive dependencies are not represented in its final citation list.

The object-level permission decision and the end-to-end information-flow property are different questions. The principle of complete mediation requires authorization to be consulted for every security-relevant access [1]. Lattice models formalize how labels compose when information flows [2]. Noninterference asks whether high or restricted inputs can influence low or public observations [3,7]. Hyperproperties generalize this idea by treating relations among multiple execution traces as first-class security properties [8].

These foundations matter because a shared evidence graph is not a folder tree. One source can support several claims. One claim can depend on several sources. A derived node can encode a restricted relationship even when none of its surface words are restricted. Conflict-of-interest policies can also depend on access history rather than a static role [4]. Decentralized label models address settings where several owners impose simultaneous constraints [5,6]. Attribute-based access control adds principal, object, action, and environment attributes to the decision [9].

Recent work has extended these concerns into learning and retrieval systems. Modular information-flow architectures have been proposed for training on access-controlled data [11]. Retrieval studies have documented extraction risk from private corpora and structured graph representations [12,14]. Authorization-first retrieval has been proposed as an ordering invariant for least privilege [13]. Cross-context interference studies show that irrelevant or conflicting context can shape outputs even when the final claim appears grounded [15].

The Cortonex question is operational:

1.1Contributions and scope

We make seven contributions.

First, we define a permission label for security-relevant evidence nodes and edges that combines sensitivity, authorized principals, and authorized workspaces. We define flow, join, graph projection, and output-level authorization over complete transitive dependencies.

Second, we formalize the public permission boundary as a noninterference property over an observable vector containing answer content, citations, metadata, confidence, and disposition.

Third, we introduce a paired-world benchmark. Each case contains two worlds with the same authorized projection and different restricted state. The evaluator can therefore distinguish output dependence on permitted evidence from output dependence on hidden evidence.

Fourth, we construct seven material leakage mechanisms and matching nonmaterial controls. Faults are instantiated in answers, citations, metadata, policy epochs, caches, workspace identity, and output disposition rather than assigned only as abstract labels.

Fifth, we prevent the fitted gate from inspecting the counterfactual pair. A random focal world is selected for every case. The gate receives only the focal execution's scalar confidence or noisy internal trace.

Sixth, we compare a scalar confidence gate, a full permission trace gate, and an exact oracle ceiling under disjoint training, calibration, threshold-selection, and held-out test populations.

Seventh, we report the operational trade-off among leakage detection, valid false holds, release coverage, calibration, and residual invalidity. We do not treat maximum suppression as a sufficient result.

The Cortonex Lab retains the versioned benchmark, record-level outputs, frozen generator, fitted-policy state, and separate numerical verification materials used to produce the study. Those internal materials are not part of the public release.

1.2Five kinds of quantity

The article contains five epistemically different kinds of quantity.

Assumed design choices include the schema families, condition counts, 88% material-fault probability, diagnostic-noise model, policy-epoch range, base release thresholds, model class, and 2% validation false-hold budget. These are not estimates of real institutions.

Constructed observations include evidence nodes, permitted and restricted facts, paired-world outputs, citation paths, metadata, confidence values, dispositions, policy epochs, workspaces, caches, and diagnostic traces.

Fitted quantities include standardized logistic coefficients, sigmoid calibration maps, and release thresholds. They are learned only from constructed training and validation populations.

Held-out measurements include the 619 of 3,590 and 3,275 of 3,590 invalid-case counts, false-hold counts, Brier scores, calibration errors, risk-coverage values, and fault-level measurements on the 6,000-case test population.

Derived scenarios include assumed operating-prevalence calculations and the exact current-policy recheck budget. They transform held-out conditional rates under additional assumptions. They are not deployment forecasts.

2Formal permission boundary

2.1Labeled evidence graph

Let the shared evidence structure be a directed graph

where $V$ contains source records, passages, entities, claims, caches, policy state, and derived objects, while $E$ contains provenance, derivation, citation, version, membership, and dependency relations. Relation existence can itself be sensitive, so security labels apply to both nodes and edges.

Each security-relevant object $x\in X$ receives a permission label

where:

• $s(x)$ is a sensitivity element in lattice $\mathcal S$;
• $A(x)$ is the set of principals authorized to observe or consume the object;
• $W(x)$ is the set of workspaces in which the object may be used.

For two labels $\lambda_1=(s_1,A_1,W_1)$ and $\lambda_2=(s_2,A_2,W_2)$, define the permitted information-flow order

Information may flow to an equal or more sensitive destination, but the destination cannot expand the permitted principal or workspace set.

The least upper bound is

The intersection terms matter. A conclusion derived jointly from two objects is not generally authorized for the union of their readers. It is authorized only where the relevant policies overlap, unless an explicit and valid declassification rule applies.

2.2Attribute-based authorization and graph projection

Let $p$ be the requesting principal, $w$ the active workspace, $a$ the requested action, $z$ the environment, and $\eta$ the current policy epoch. For any node or edge $x\in X$, define

This follows the attribute-based view in which subject, object, action, workspace, and environment attributes are evaluated against current policy [9].

The authorized node set is

and the authorized edge set and projected graph are

Filtering nodes while retaining a restricted relationship can still disclose information. Equation (7) therefore treats edge authorization as part of the public projection.

For a component without verified internal information-flow confinement, the conservative architecture constructs its candidate context from $G_{p,w,a,\eta}$ before restricted state can influence internal computation. This ordering is sufficient but not universally necessary. A formally verified information-flow architecture may consume labeled restricted state while still proving noninterference. The benchmark does not evaluate such an architecture.

2.3Derived outputs and dependency closure

For any public derived object $o$ with a nonempty dependency set, including a claim, citation annotation, metadata field, confidence signal, or disposition, let $D(o)\subseteq V\cup E$ be its complete transitive dependency set. Its output label is

Let $\kappa_{\eta}(p,w,a,z)$ denote the sensitivity clearance supplied by current policy. Output-level authorization is

Equation (9) is meaningful only when $D(o)$ is complete. A citation list is not necessarily a dependency set. A permitted citation can accompany an output whose actual computation also depended on a restricted node, a restricted relationship, a stale cache entry, a hidden intermediate claim, a confidence computation, or a refusal rule.

2.4Low equivalence and public observables

Consider two worlds $G^0$ and $G^1$. They are low-equivalent for request context $(p,w,a,\eta)$ when their authorized projections are equivalent:

The relation $\cong$ means an isomorphism that preserves authorized node content, authorized edge relations, security labels, policy-relevant attributes, and public semantics, while permitting renaming of identifiers with no public semantic effect. Restricted nodes may differ arbitrarily.

For one execution, define the public observable vector

where:

• $Y$ is answer or claim content;
• $C$ is the citation surface;
• $M$ is public metadata, including titles, counts, identifiers, and provenance labels;
• $\Gamma$ is the visible confidence or uncertainty signal after the benchmark applies the same four-decimal rendering exposed to the requester;
• $\rho$ is disposition, including answer, refusal, hold, or escalation.

A deterministic system $F$ satisfies request-scoped noninterference when

For randomized systems, the corresponding distributional condition is

where $\mathcal L$ denotes probability law. Equation (13) is stronger than equality of one sampled answer. It requires the observable distributions to agree.

For channel $k\in\{Y,C,M,\Gamma,\rho\}$ in paired case $i$, define

and any-channel leakage

The benchmark uses deterministic outputs within each constructed world. Confidence is compared at its public four-decimal representation rather than at an unexposed internal precision. Equation (12) and the indicators in Equations (14) and (15) are therefore the operative tests. Equation (13) states the broader property required when system randomness remains active.

2.5Permission-valid record

Define answer fidelity

where $Y_i^*$ is the expected answer from the common authorized projection.

Citation authorization is

Dependency authorization is

The paired-world noninterference indicator is

Current-policy coherence is

and workspace isolation is

Define permission safety and release validity by

No independence assumption is implied by either product. Every factor is binary. Permission safety, $\Pi_i$, concerns authorization and information flow. Release validity, $V_i$, additionally requires the expected authorized answer. The frozen benchmark does not contain a separate class of permission-safe answer errors: every material fault violates noninterference and at least one additional permission predicate, while every clean or nonmaterial control preserves permission safety and answer fidelity. Consequently, $\Pi_i=V_i=1-\mathsf{Mat}_i$ in this construction. Dependency authorization applies to every public derived object, not only prose claims. The benchmark measures whether the fitted observability channels identify those constructed permission violations, not whether leakage has a universal natural frequency.

2.6Two propositions

Proposition 1. Post-generation answer redaction is insufficient for noninterference.

Let $R$ modify only answer channel $Y$. If low-equivalent worlds produce unequal values in any other public channel $k\in\{C,M,\Gamma,\rho\}$, then $R\circ F$ violates Equation (12).

Proof. Redaction changes only $Y$. For the unequal channel $k$, $\mathcal O_k(R(F(G^0)))=\mathcal O_k(F(G^0))$ and $\mathcal O_k(R(F(G^1)))=\mathcal O_k(F(G^1))$. Those values remain unequal, so the modeled observable vectors remain unequal. Therefore noninterference does not hold. $\square$

The proposition is elementary but operationally important. A system can remove every restricted phrase from the answer and still leak through a citation title, source count, confidence shift, refusal reason, or review route.

Proposition 2. Complete mediated flow is sufficient under explicit assumptions.

For a component without a separately verified internal information-flow proof, suppose that:

1. candidate construction consumes only $G_{p,w,a,\eta}$;
2. every public derived object carries the join of a complete transitive dependency set;
3. every public derived object and every channel in Equation (11) is released only after output authorization under the same current policy epoch;
4. caches are keyed by principal, workspace, action, and policy epoch, and are invalidated on revocation;
5. authorized projections are canonicalized, or the computational component is invariant under the isomorphism in Equation (10); conditional on that authorized representation, the component is deterministic or its randomized output law is independent of restricted state.

Then low-equivalent worlds satisfy Equation (12), or Equation (13) in the randomized case.

Proof sketch. Low-equivalent worlds supply isomorphic authorized projections. Conditions 1 and 4 prevent restricted or cross-context state from entering the consumed state. Condition 2 prevents a public derived object from omitting a restricted dependency. Condition 3 applies the same policy decision to every public channel. Under Condition 5, canonicalization or isomorphism invariance maps the two authorized projections to the same effective input. That input yields equal deterministic observables or equal observable distributions. Restricted differences are therefore unable to change the public observable vector. $\square$

The proposition is conditional and describes one conservative sufficient architecture. It is not a theorem that all secure systems must exclude restricted state before computation. Verified information-flow architectures can use other constructions. In real systems, the hard problems are proving dependency completeness, enforcing complete mediation, maintaining current policy state, and bounding hidden state inside caches and learned components.

3Paired-world benchmark

3.1Case anatomy

The benchmark contains 30,000 cases. Each case instantiates two evidence-graph worlds with:

• one requesting principal;
• one active workspace;
• one current policy epoch and one prior epoch;
• three authorized facts;
• one authorized source;
• one restricted state that differs between worlds;
• one query requesting current status, measure, and control using authorized sources only;
• world-specific answer, citation, metadata, confidence, and disposition channels;
• exact permission predicates and noisy instrumentation readings.

The two worlds share the same authorized projection. They differ only in restricted state. All mechanism-independent random quantities, including baseline confidence, confidence perturbation magnitude, refusal confidence, foreign-workspace status, principal, workspace, policy epoch, authorized facts, and diagnostic draws, are sampled once per case and shared across the pair. World-specific behavior is then a deterministic function of the restricted state. The private generator materializes a compact typed graph with authorized and restricted source nodes, policy and workspace state, a public derived-output node, and labeled support, influence, policy, and workspace edges. It is not a large free-form institutional graph. For example, a legal-schema case may contain privileged settlement band low in World A and privileged settlement band high in World B. Neither value is authorized for the requesting principal. A secure execution should therefore expose the same public observable in both worlds.

Each domain-labelled schema family contains 10,000 cases:

These labels provide typed variation. They do not establish performance in any real domain.

3.2Condition allocation

Each 10,000-case schema family uses the same fixed condition allocation:

For a nonclean condition, materiality is sampled as

The full benchmark realizes 17,945 material faults among 20,400 nonclean cases, a materiality rate of 87.97%. The remaining 2,455 nonclean cases are safe controls. They preserve permission validity while making diagnostic signals less separable. Clean cases are always permission-valid.

The condition allocation and materiality probability are stress-design choices. They are not estimates of operational leakage prevalence.

3.3Seven leakage mechanisms

Restricted retrieval. A restricted node enters the reasoning context before authorization is enforced. Its world-specific value is emitted and cited.

Citation metadata exposure. The requested answer remains authorized, but the citation surface and source metadata expose the restricted node and its world-specific state.

Derived claim exposure. A conclusion changes with the restricted state even though the restricted source is neither quoted nor cited.

Confidence side channel. Answer, citation, metadata, and disposition remain fixed, but visible confidence changes with the restricted state.

Refusal side channel. One world receives an answer while the other receives a refusal that confirms restricted evidence affects the request.

Revocation lag. A cached source from the prior policy epoch remains available after revocation and influences the answer.

Cross-workspace contamination. Context from another workspace influences the answer and citation path for the requesting workspace.

The matching safe controls retain the same condition label but preserve permission validity. For example, a restricted candidate may enter a pre-filter pool and then be removed before context assembly. A source alias may resolve to an authorized record before metadata is emitted. A cached source may remain valid under the current policy epoch. A shared source may carry an explicit joint-workspace label.

3.4Paired evaluator and focal execution

The paired evaluator has access to both world observables and computes Equation (22). The fitted release policies do not.

For each case, select a focal world

Only the focal execution supplies the policy features. The counterfactual world is retained for evaluation. The release-validity label is used as a supervised target only on the training, calibration, and threshold-selection populations. It is never included in the inference feature vector. The initial split is stratified by schema family, condition, and materiality, then frozen before fitting. After that point, held-out labels are not used for coefficient fitting, probability calibration, threshold selection, or model selection. This prevents a fitted gate from solving the task by directly comparing paired outputs or reading the held-out benchmark answer key.

The base release rule holds the focal execution when its policy-facing scalar confidence score is below 0.55 or a required answer output is absent:

where $m_i$ indicates a missing required output and $g_i$ is the policy-facing scalar confidence score defined in Equation (32). This score is distinct from the four-decimal public confidence channel $\Gamma$ used by the paired noninterference evaluator.

A base-silent permission failure is

This is the primary operational failure state: the paired evaluator identifies permission invalidity, but the ordinary focal release rule passes the case.

3.5Noisy permission instrumentation

The benchmark distinguishes exact evaluator state from observable diagnostic state. Exact authorization predicates define validity. Fitted policies receive noisy measurements derived from concrete permission state.

Each case receives a complexity variable

For diagnostic channel $j$, telemetry dropout is

Let $u_{ij}\in[0,1]$ be the latent condition that channel $j$ is intended to inspect, and let $r_j\in[0,1]$ be the channel reliability parameter. The noisy center is

with standard deviation

The observed reading is

Conditioned on $\chi_i$, the dropout indicators and Gaussian disturbances are sampled independently across diagnostic channels. The shared complexity variable induces cross-channel dependence even though the channel-specific draws are conditionally independent.

The full trace uses eight observed channels:

The inherited field names are retained because the article payload must remain compatible with the existing figure contract. Their permission-specific meanings are stated explicitly in the figure specification.

The latent templates are fully specified below. They are design inputs, not measured detector quality. Safe denotes a permission-valid near-boundary control; material denotes the constructed fault. The seven columns correspond to workspace continuity, policy epoch, public-channel mediation, citation authorization, dependency closure, candidate separation, and cache or workspace provenance.

The table makes the benchmark's strongest assumption visible: the full trace has access to noisy sensors targeted at the invariants violated by the constructed faults. The experiment measures what those channels make observable after dropout and noise. It does not establish that a field system can measure the same channels at the same quality.

Let $c_i^{J_i}$ be the focal world's native public confidence, $u_i^{\mathrm{cit}}$ the latent citation state, and $u_i^{\mathrm{src}}$ the latent source-integrity state. The separate policy-facing scalar score is

where

The diagnostic model is not intended to imitate a particular deployed system. It creates overlapping, imperfect instrumentation so that the fitted gate does not receive exact permission predicates.

3.6Splits, fitting, and threshold selection

The 30,000 cases are divided before final evaluation:

Splits are stratified by schema family, condition, and materiality.

For policy $k$, let $\mathbf z_i^{(k)}$ be its standardized focal feature vector. The raw validity score is

where $\sigma(x)=(1+e^{-x})^{-1}$. The logistic fit uses balanced class weights.

A separate sigmoid calibration map is fitted on the calibration population using an L2 logistic fit with $C=10^{12}$:

The implementation fits Equation (35) to the raw logistic decision score, which is algebraically equal to $\operatorname{logit}(q_i^{(k)})$ before numerical clipping.

The fitted gate can add a hold but cannot reverse the base hold:

with

Probabilities within $10^{-12}$ of the threshold are treated as equal to it, preventing decimal serialization or platform roundoff from changing a tie.

The operating threshold is selected on the threshold-selection population to maximize permission-invalid detection subject to a 2% valid false-hold budget:

Candidate thresholds are the distinct calibrated probabilities observed in the threshold-selection population, together with 0 and 1. If several feasible thresholds achieve the same maximum invalid-case detection, the implementation chooses the largest threshold under the numerical equality rule in Equation (37).

The threshold-selection population contains 1,207 valid cases, so the integer budget is $\lfloor 0.02\times 1{,}207\rfloor=24$. Both final fitted policies hold exactly 24 valid cases, remaining within that budget. This is a constraint on threshold selection, not a guarantee that the held-out false-hold rate will remain below 2%. Their selected thresholds are:

The held-out test labels do not fit coefficients, calibrate probabilities, or select thresholds.

3.7Evaluation metrics

For held-out case set $\mathcal I$, permission-invalid detection is

Base-silent detection is

Valid false-hold rate is

Release coverage is

and invalidity among released cases is

provided at least one case is released.

The Brier score is

Using ten equal-width probability bins $B_m$, expected calibration error is

Observed proportions are accompanied where relevant by two-sided nominal 95% Wilson intervals:

These intervals are finite-count Bernoulli summaries. They are not field-population confidence intervals and do not represent uncertainty over every possible benchmark construction.

4Held-out results

4.1Test composition

The held-out test population contains 6,000 paired cases:

The invalid cases partition exactly into base-silent and overt failures:

The stress-suite invalid prevalence is therefore

and the base-silent invalid rate over all held-out cases is

Those values follow from the deliberately fault-rich allocation and 88% materiality design. They are not estimates of permission failure in deployed systems.

4.2Scalar confidence is a weak boundary signal

The scalar gate holds 619 of 3,590 permission-invalid cases:

Of the 3,263 base-silent cases, it holds 292:

It false-holds 49 of 2,410 valid cases:

The gate releases 5,332 cases:

Among those released cases, 2,971 are permission-invalid:

A high answer-confidence value is therefore not a permission certificate in this construction. Several leakage mechanisms preserve a fluent or highly confident answer precisely because restricted evidence makes the system more certain.

4.3The trace gate exposes more failure classes

The trace gate holds 3,275 of 3,590 permission-invalid cases:

It holds 2,948 of 3,263 base-silent cases:

It false-holds 65 of 2,410 valid cases:

The 2.6971% test-set value exceeds the 2% validation budget used to select the threshold. There is no mathematical contradiction. The 2% figure constrains one finite threshold-selection population; it is not a held-out performance guarantee.

The trace gate releases 2,660 cases:

Of those releases, 315 are permission-invalid:

The residual base-silent rate over the full test population is

Relative to the scalar gate, invalidity among released cases falls by

Release coverage falls by

This trade-off is part of the result. A permission gate that holds every case would eliminate released leakage by refusing to operate. The relevant question is whether a policy reduces released permission failure while preserving enough valid work to remain useful.

4.4Uncertainty on observed rates

For the trace gate, the two-sided nominal 95% Wilson interval for valid false holds, rounded to four decimal places, is

based on 65 holds among 2,410 valid cases.

The corresponding rounded interval for permission-invalid detection is

and the rounded interval for base-silent detection is

For the scalar gate, the rounded false-hold interval is

its rounded permission-invalid detection interval is

and its rounded base-silent detection interval is

These intervals are finite-count Bernoulli summaries. They do not represent deployment guarantees, design-based uncertainty over the deliberately constructed benchmark, or uncertainty over every possible benchmark construction.

4.5Ranking, calibration, and operating behavior

The trace policy ranks valid and invalid cases much more effectively than the scalar policy under this construction. Its Brier score and ten-bin calibration error are also lower.

Calibration is not a security proof. A probability model can be calibrated at group level while missing a consequential leakage class. The confidence-side-channel results below make that distinction concrete. Permission evaluation must consider channel-specific failure, not only global probability quality.

4.6Progressive permission evidence

Each row in the following ladder is fitted, calibrated, thresholded, and evaluated independently. The rows do not represent one model updated in place.

The selected operating points are not guaranteed to improve monotonically when a noisy channel is added. Each row is fitted independently under the same validation constraint. A richer feature set can improve overall ranking while moving the finite-sample threshold trade-off in either direction.

Figure 1 maps mean diagnostic values across clean and material fault classes. Figure 2 separates fault-level detection, false holds, and residual invalidity. Figure 3 presents the progressive control stack. Figure 4 shows risk-coverage curves over the disclosed 0.01 threshold grid, and Figure 5 compares fitted validity calibration.

5Seven leakage surfaces

The aggregate trace result conceals substantial variation. The fault classes are not interchangeable.

5.1Restricted retrieval

A restricted node enters the reasoning context before authorization filtering. The world-specific restricted value is emitted and cited.

In the held-out set, 640 of 721 restricted-retrieval cases are permission-invalid. The trace gate holds 620 of them, or 96.88%, and 600 of 620 base-silent cases, or 96.77%. The scalar gate holds 77 invalid cases, or 12.03%.

This class is comparatively visible because several channels move together: citation authorization weakens, dependency closure weakens, candidate separation contracts, and source integrity degrades.

For components without verified internal information-flow confinement, the conservative implication is direct. Authorization should constrain context construction before a restricted candidate can alter component state. Authorization-first work frames this as a pipeline-ordering invariant rather than a behavioral request to the reasoning component [13].

5.2Citation metadata exposure

The answer remains fully authorized. The leak appears in the citation surface or source metadata.

The held-out class contains 527 invalid cases. The trace gate holds 494, or 93.74%, and 485 of 518 base-silent cases, or 93.63%. Its valid false-hold rate within the class is 5.48%.

The system can be factually correct and still disclose a restricted source title, relationship, identifier, or state. Structured graph systems expand this surface because node and edge metadata can itself be sensitive [14].

5.3Derived claim exposure

A derived conclusion changes with restricted state even though the restricted source is omitted from citations.

The trace gate holds 534 of 629 invalid cases, or 84.90%. All 629 invalid cases are base-silent in this class, so the base-silent detection rate is also 84.90%. The scalar gate holds 6 invalid cases, or 0.95%.

This is the dependency-closure problem. Citation correctness is not enough. Every public derived object must carry the join of every source, relation, and intermediate state that materially influences it. If the dependency set is incomplete, Equation (8) labels the visible explanation rather than the actual computation.

5.4Confidence side channel

Answer content, citations, metadata, and disposition remain equal. Visible confidence changes with restricted state.

This remains the hardest fitted class. The trace gate holds 382 of 529 invalid cases, or 72.21%, and 376 of 523 base-silent cases, or 71.89%. It releases 147 invalid confidence-side-channel cases. No valid safe control in this held-out class is false-held by either fitted policy.

The result is not a universal confidence-leakage rate. It shows that permission traces centered on sources and citations can still miss a public signal that encodes restricted influence indirectly.

Confidence should therefore be treated as a governed output channel. If it is public, its computation must depend only on the authorized projection, be protected by verified internal information-flow controls, or be evaluated separately for distributional noninterference.

5.5Refusal side channel

One world receives an answer and the other a refusal that confirms restricted evidence affects the request.

The base rule catches many cases when the focal execution is the refusal world. The trace gate holds 405 of 424 invalid cases, or 95.52%, and 194 of 213 base-silent cases, or 91.08%. Its valid false-hold rate within the class is 6.90%.

A refusal can be safer than an unauthorized answer and still reveal a protected fact. The response policy must remain coherent across low-equivalent worlds. This may require a generic hold derived only from the authorized projection, not a reason that confirms restricted evidence exists.

5.6Revocation lag

A cached source created under policy epoch $\eta_i-1$ remains available after revocation at epoch $\eta_i$.

The trace gate holds all 473 invalid cases and all 451 base-silent cases in the held-out class. Its valid false-hold rate within the class is 7.69%. Policy-epoch and cache-provenance diagnostics make the constructed mechanism completely separable at the selected operating point.

That exact class result is a property of this generated mechanism and diagnostic model. It is not a claim of perfect revocation handling in deployed infrastructure.

5.7Cross-workspace contamination

A result in one workspace uses state from another workspace. The two paired worlds share the same foreign-workspace status and all other exogenous construction draws. Only the restricted state differs.

The trace gate holds 367 of 368 permission-invalid cases, or 99.73%, and 308 of 309 base-silent cases, or 99.68%. It false-holds 5 of 52 valid safe controls, or 9.62%.

The high detection rate and high within-class false-hold rate arise from strong workspace and provenance separation in the material mechanism and deliberately ambiguous diagnostics in its safe controls. Neither value is a field tenant-isolation estimate.

5.8Fault-level summary

The clean held-out population contains 1,920 cases. The trace gate false-holds 37, or 1.93%. The scalar gate false-holds 31, or 1.61%.

The table should not be read as a leaderboard of deployable controls. The fault mechanisms and diagnostics are constructed together. It identifies which kinds of permission evidence are required to make each mechanism observable under the disclosed noise model.

6Why redaction is too late

Post-generation redaction asks whether visible content contains a restricted token, entity, or passage. The permission boundary asks whether the entire public behavior depends on restricted state.

Those questions coincide only in the simplest direct-disclosure case.

A redactor can remove a restricted sentence while leaving:

• a source title that identifies the restricted matter;
• a confidence increase that reveals corroborating hidden evidence;
• a refusal that confirms a protected condition;
• a derived priority or risk label produced from a restricted node;
• an answer shaped by a stale, revoked cache;
• a citation from another workspace;
• a count or provenance path that reveals the existence of restricted material.

The paired-world construction tests the dependence directly. When two worlds have the same authorized projection, every public difference is evidence that restricted state crossed the boundary.

This leads to three distinct enforcement points.

Before context. Authorization constrains the retrieval candidate set. Restricted evidence does not enter a component whose state can affect output.

During derivation. Labels propagate through complete transitive dependencies. A derived claim cannot become less restrictive merely because its restricted source disappears from the final citation surface.

At release. Every public channel, including metadata, confidence, refusal, and review route, is mediated under the current principal, workspace, action, and policy epoch.

A post-generation redactor operates only at the third stage and usually only on $Y$. Proposition 1 shows why that cannot establish noninterference.

7Revocation, recheck, and selective release

7.1Risk-prioritized exact permission recheck

The trace gate leaves 315 base-silent permission-invalid cases in the held-out set. To study a stronger verification path, we rank trace-released cases from lowest to highest fitted validity probability and apply an idealized exact permission recheck to increasing fractions of that release set.

Let $R_i(q)$ indicate that trace-released case $i$ is selected at recheck fraction $q$. The overlay hold is

Equation (72) uses the exact benchmark validity bit for selected cases. The ranking comes from the fitted trace probability, but the recheck itself is an oracle. This is an architectural budget curve, not a measured verifier.

The selected count at each row is a fraction of the 2,660 trace releases, while the second column reports that count as a fraction of all 6,000 test cases. The nested subsets are selected by the lowest fitted trace probabilities first. This is a risk-prioritized hypothetical allocation, not a random sample and not an observed deployment workflow.

At full recheck, release remains below the standalone oracle's 40.17% because the overlay cannot reverse 65 valid holds already imposed by the trace gate.

7.2Conditional operating prevalence

The stress suite contains far more permission-invalid cases than a well-operated production system should. To separate class-conditional behavior from stress-suite composition, let:

• $\varrho$ be an assumed operating permission-invalid prevalence;
• $d_k$ be held-out invalid detection for policy $k$;
• $f_k$ be held-out valid false-hold rate.

The estimated hold rate is

and estimated release rate is

Residual invalidity over all cases is

and invalidity among released cases is

At an assumed 5% permission-invalid prevalence:

These values assume the held-out conditional detection and false-hold rates transfer unchanged to the new environment. That assumption has not been validated in a deployment. The table is sensitivity analysis, not a forecast.

Figure 6 contains the risk-prioritized exact-recheck budget. Figure 7 exposes six paired-world traces so the reader can inspect which channel changed and why the fitted gate held or released the case.

8Architectural invariants

The study does not identify one sufficient product feature. It identifies a set of architectural conditions that must hold together.

8.1Authorization before context

For any component without a separately verified internal information-flow proof, the conservative candidate set is constrained before retrieved evidence enters state capable of influencing a public output:

A retrieve-then-filter architecture may satisfy surface filtering while violating Equation (12), because restricted evidence has already entered the computation [13]. This is not a claim that secure labeled computation is impossible. It is a boundary rule for components whose internal information flow has not been proved.

8.2Label-preserving derivation

Every public derived object must carry the join of its complete dependency closure:

The dependency closure must include intermediate claims, cached summaries, tool outputs, graph edges, confidence computations, refusal rules, and hidden state that materially influences the result. A hand-selected citation list is not a substitute.

8.3Complete mediation of public channels

Every component of $\mathcal O$ must be governed:

This includes signals often treated as presentation detail. Confidence, source counts, titles, refusal reasons, routing labels, and review states can all carry information.

8.4Current policy epoch

Every permission decision, cache entry, and derived object must be bound to a policy epoch:

Revocation requires invalidation or revalidation across the complete dependency path, not merely removal of the original source from a user interface.

8.5Workspace isolation

Absent an explicit cross-context authorization, all mutable state that can influence reasoning must be keyed injectively by the active security context. Let $c=(p,w,a,\eta)$ and let $K_x(c)$ be the key used for state object $x$:

Depending on the architecture, the context may also include tenant, purpose, matter, project, jurisdiction, or conflict-of-interest state. The exact tuple is application-specific. Equation (81) states a default isolation requirement, not a prohibition on authorized sharing. State may be reused across contexts only when its label and current policy explicitly permit that flow.

8.6Governed abstention

When dependency closure, policy currentness, or workspace provenance cannot be established, the system should not manufacture certainty. It should produce a policy-consistent hold whose public reason does not itself reveal restricted state.

A safe hold is therefore constrained by the same noninterference requirement as an answer:

The hold can disclose that the request cannot be completed under the authorized projection. It should not confirm why a restricted world differs.

8.7Verification as a boundary record

A release decision should preserve enough state to establish:

• which principal, workspace, action, and policy epoch governed the request;
• which authorized projection was constructed;
• which source and intermediate dependencies influenced each public derived object;
• which labels were joined;
• which public channels were evaluated;
• which cache and retrieval contexts were used;
• which condition caused a hold or release without disclosing restricted content to the requester.

This is not merely an audit log. It is the evidence needed to determine whether the permission boundary was evaluated at the same granularity as the reasoning process.

9Limitations

This study has deliberate boundaries.

9.1Constructed evidence, not field prevalence

The benchmark is programmatically constructed. Its 59.83% held-out invalid prevalence and fault allocation are stress-design choices. They do not estimate how often real organizations experience permission leakage.

9.2Paired deterministic outputs

The benchmark evaluates deterministic paired observables. Confidence is compared at the four-decimal representation exposed by the constructed interface, not hidden full precision. A deployment must define and test its actual public precision. Randomized systems require repeated sampling or other distributional tests for Equation (13). Equality of one sampled pair does not establish distributional noninterference.

9.3Shared exogenous construction state

All exogenous random draws are sampled once per pair and shared across both worlds. The only world-specific input is restricted state, followed by deterministic mechanism behavior. This supports the intended counterfactual interpretation inside the construction. It does not prove that every unmeasured nuisance variable has been controlled in a real system.

9.4Finite paired coverage

The evaluator changes one declared restricted state per paired case. Passing a finite set of low-equivalent pairs does not prove noninterference for every possible restricted value, query, graph topology, policy combination, or execution history. The pairs are test cases, not a universal proof.

9.5Small typed graph templates

Each case contains an explicit but compact labeled graph with source, policy, workspace, support, influence, and output objects. It does not reproduce the scale, topology, schema ambiguity, or multi-owner policy complexity of a large institutional graph.

9.6Exact evaluator state

The paired evaluator knows the authorized projection, complete dependencies, current policy epoch, workspace boundary, and world-specific restricted state. Real systems must infer or enforce these quantities under incomplete metadata and changing policy.

9.7Constructed diagnostics

The trace channels are noisy instruments generated from disclosed latent templates tied to exact constructed permission state. They are not measured outputs from a deployed reference monitor, graph engine, retrieval service, or reasoning component. The 91.23% result is therefore an observability result under this diagnostic model.

9.8Coextensive materiality and validity

Every material fault is constructed to violate noninterference and at least one additional permission predicate, while every clean or nonmaterial control preserves permission safety and answer fidelity. Permission safety, release invalidity, and paired-world leakage are therefore coextensive in the frozen benchmark. A broader evaluation should include permission-safe answer errors, policy-invalid but observationally equal states, purpose limitation, aggregation, and quantitative leakage budgets.

9.9No training-data or parameter leakage

The benchmark treats fitted policy parameters and the underlying reasoning component as fixed before paired evaluation. It does not test whether restricted training examples, parameter memorization, model updates, or fine-tuning state can leak into outputs. Those are separate information-flow problems [11].

9.10No adaptive attacker

The benchmark evaluates one paired request per case. It does not model a principal who issues sequences of correlated queries, estimates hidden state statistically, or combines outputs across time. Confidence and refusal channels may become more exploitable under repeated interaction.

9.11No physical side channels

The observable vector covers answer content, citations, public metadata, four-decimal confidence, and disposition. It does not cover latency, token count, packet size, network behavior, resource consumption, cache timing, memory pressure, or other physical side channels.

9.12Binary leakage criterion

Any modeled-channel difference counts as leakage. This binary criterion does not estimate information capacity, attacker advantage, exploitability, repeated-query extraction rate, or the operational severity of the disclosed difference. A one-bit confidence signal and direct restricted-fact disclosure are both failures under Equation (15), but they are not equally harmful.

9.13Limited utility measurement

Utility is represented by valid release, false holds, release coverage, and residual invalidity. The study does not measure long-form reasoning quality, reviewer time, latency, compute cost, or the value of partially authorized answers.

9.14No sanctioned declassification

The formal model assumes no declassification unless explicitly authorized. Real institutions may permit aggregate, transformed, delayed, or purpose-limited disclosure. Such rules require explicit semantics and separate evaluation.

9.15Conservative context-ordering invariant

The article recommends authorization before context construction for components without verified internal information-flow confinement. That is a conservative sufficient architecture, not a universal necessity theorem. A system with proved label-preserving internal computation may securely consume restricted state under different rules.

9.16Protocol development and non-preregistration

Pilot runs were used to debug benchmark mechanisms, diagnostic overlap, and audit logic before the final protocol was frozen. The study was not preregistered. The reported held-out population was not used for coefficient fitting, probability calibration, or threshold selection, but the held-out designation should not be interpreted as eliminating every form of human influence from earlier benchmark design.

9.17Oracle ceiling

The exact permission oracle uses

Its perfect separation is true by construction. The public payload retains the inherited gate string Exact current-source oracle for compatibility with existing figure code, but the visible article label is Exact permission oracle. The value is the exact benchmark release-validity bit. It is not a learned detector, a calibrated probability, an independently measured verifier, or Cortonex production performance. It has no meaningful AUROC, average precision, Brier score, or calibration error.

10Study specification and verification

This study uses a fixed programmatically constructed paired-world permission benchmark. The public article reports the formal security property, node and edge label model, benchmark composition, fault mechanisms, shared-exogenous pairing rule, split protocol, exact latent diagnostic templates, noise process, release-policy definitions, calibration method, threshold-selection rule, aggregate results, confidence intervals, conditional scenarios, and principal limitations.

The Cortonex Lab retains the versioned benchmark, world-specific observables, record-level fitted outputs, frozen generator, fitted-policy state, and a separate audit implementation. These internal research materials are not part of the public release.

The final substantive benchmark, held-out outputs, fitted summary, and compact public figure payload were generated four times from the frozen protocol and were byte-identical. A separate verification implementation performed 847,580 checks over record semantics, shared paired-world exogenous state, graph labels, paired observables, split integrity, reconstructed fitted probabilities, threshold optimality, held-out metrics, Wilson intervals, calibration bins, feature-ladder policies, every public figure, conditional scenarios, trace examples, recursive payload schema, and cross-run determinism. No failed check remained.

The numerical audit is internal verification, not outside peer review or third-party certification. The public release contains only the article, aggregate figure values, and six explicitly constructed examples. Record-level data, fitted coefficients, generator code, run logs, and private verification materials are retained internally.

Data and code availability. This study uses a constructed reference benchmark. The experimental design, benchmark composition, fault conditions, metrics, aggregate results, and limitations are documented in this publication. Record-level benchmark data and the reference implementation are retained by The Cortonex Lab and are not publicly distributed.

@techreport{cortonexlab-permission-boundary,
  author      = {{The Cortonex Lab}},
  title       = {The Permission Boundary: Measuring Information Leakage in
                 Permission-Aware Reasoning Across Shared Evidence Graphs},
  institution = {The Cortonex Lab, Cortonex Technologies Inc.},
  version     = {1.2},
  url         = {https://cortonex.com/lab/permission-boundary/},
  note        = {Controlled constructed paired-world permission benchmark;
                 no production-performance claim.}
}

References

[1] Jerome H. Saltzer and Michael D. Schroeder. "The Protection of Information in Computer Systems." Proceedings of the IEEE, 63(9):1278-1308, 1975. DOI: 10.1109/PROC.1975.9939.

[2] Dorothy E. Denning. "A Lattice Model of Secure Information Flow." Communications of the ACM, 19(5):236-243, 1976. DOI: 10.1145/360051.360056.

[3] Joseph A. Goguen and José Meseguer. "Security Policies and Security Models." 1982 IEEE Symposium on Security and Privacy, pages 11-20, 1982. DOI: 10.1109/SP.1982.10014.

[4] David F. C. Brewer and Michael J. Nash. "The Chinese Wall Security Policy." 1989 IEEE Symposium on Security and Privacy, pages 206-214, 1989. DOI: 10.1109/SECPRI.1989.36295.

[5] Andrew C. Myers and Barbara Liskov. "A Decentralized Model for Information Flow Control." Proceedings of the Sixteenth ACM Symposium on Operating Systems Principles, pages 129-142, 1997. DOI: 10.1145/268998.266669.

[6] Andrew C. Myers and Barbara Liskov. "Protecting Privacy Using the Decentralized Label Model." ACM Transactions on Software Engineering and Methodology, 9(4):410-442, 2000. DOI: 10.1145/363516.363526.

[7] Andrei Sabelfeld and Andrew C. Myers. "Language-Based Information-Flow Security." IEEE Journal on Selected Areas in Communications, 21(1):5-19, 2003. DOI: 10.1109/JSAC.2002.806121.

[8] Michael R. Clarkson and Fred B. Schneider. "Hyperproperties." Journal of Computer Security, 18(6):1157-1210, 2010. DOI: 10.3233/JCS-2009-0393.

[9] Vincent C. Hu, David Ferraiolo, Richard Kuhn, Adam Schnitzer, Kenneth Sandlin, Robert Miller, and Karen Scarfone. Guide to Attribute Based Access Control (ABAC) Definition and Considerations. NIST Special Publication 800-162, 2014, updated 2019. DOI: 10.6028/NIST.SP.800-162.

[10] Ray Spencer, Stephen Smalley, Peter Loscocco, Mike Hibler, Dave Andersen, and Jay Lepreau. "The Flask Security Architecture: System Support for Diverse Security Policies." 8th USENIX Security Symposium, pages 123-139, 1999.

[11] Trishita Tiwari, Suchin Gururangan, Chuan Guo, Weizhe Hua, Sanjay Kariyappa, Udit Gupta, Wenjie Xiong, Kiwan Maeng, Hsien-Hsin S. Lee, and G. Edward Suh. "Information Flow Control in Machine Learning through Modular Model Architecture." 33rd USENIX Security Symposium, pages 6921-6938, 2024.

[12] Shenglai Zeng, Jiankun Zhang, Pengfei He, Yue Xing, Yiding Liu, Han Xu, Jie Ren, Shuaiqiang Wang, Dawei Yin, Yi Chang, and Jiliang Tang. "The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation." Findings of the Association for Computational Linguistics: ACL 2024, pages 4505-4524, 2024. DOI: 10.18653/v1/2024.findings-acl.267.

[13] Rohith Namboothiri. "Authorization-First Retrieval: Enforcing Least Privilege in Multi-Agent RAG Systems." Proceedings of the 6th Workshop on Trustworthy NLP, pages 256-271, 2026. DOI: 10.18653/v1/2026.trustnlp-main.15.

[14] Jiale Liu, Jiahao Zhang, and Suhang Wang. "Exposing Privacy Risks in Graph Retrieval-Augmented Generation." Findings of the Association for Computational Linguistics: ACL 2026, pages 18073-18093, 2026. DOI: 10.18653/v1/2026.findings-acl.899.

[15] Rohith Namboothiri. "Ghost Context: Measuring Cross-Context Interference in Long-Context Language Models." Proceedings of the 6th Workshop on Trustworthy NLP, pages 316-329, 2026. DOI: 10.18653/v1/2026.trustnlp-main.19.