A command authorization is meant to be used once. The real risk isn't only an outsider sending commands — it's a captured, already-valid authorization being replayed after it should be spent. This is a controlled test of whether an action gate rejects that replay — backed by evidence anyone can re-run.
A legitimate authorization is issued for one action and consumed. The adversary then re-submits the same authorization, hoping the gate trusts it again because it was valid once.
The gate treated the second use as an attack, not a retry. It didn't re-authorize — and, the part most systems get wrong, it didn't report success while silently doing nothing. The verdict and the simulated effect matched.
Every run emits a signed evidence capsule: the decision, its reason, the parameters and a verification token. In testing, every tampering attempt was caught — altering a record, the reason, the stored token or a signature all make verification fail. It's built to be checked by a party who didn't run the test.
A result reported by the tool that produced it is a claim, not proof. So the suite was re-run from a clean environment — fresh virtual environment, freshly installed dependencies, no reuse of the build that produced the original numbers — and the repository state was hashed before and after.
Reproduced from scratch — not taken on trust. The run altered nothing: git status and the evidence-file hashes were identical before and after. Pinned to an immutable commit, so this case stays valid over time.
Synthetic, not physical. This ran software-only against a mock actuator. No robot moved; physical validation remains blocked pending an independent hardware stop. Nothing here is a claim about physical hardware.
Tamper-evident, not yet authenticated. Every content, token or signature change tested was detected. The one residual gap: the signing key sits beside the capsule, so a party able to rewrite all of it could produce a self-consistent set. A trusted external channel for the key closes this.
Reproduced, not certified. A passing test count is evidence the behaviour holds under the cases tested. It is not a certification, and not a guarantee against untested inputs.
In a synthetic environment, Cyber Kimura demonstrated that a consumed authority cannot be replayed: a second request carrying an already-used authorization was rejected (AUTHORITY_ALREADY_CONSUMED) by an enforcement path confirmed through mutation testing, backed by a tamper-evident evidence capsule — and the result was reproduced independently from a clean environment, with the repository verified unchanged.
Next case: Authority After Change — does an unused permission survive a new activation? →
AI agents, drones, robots — one method: does authority hold, end to end, and keep holding after things change?
Request an assessment →