RevocationBench: A Local Fault-Injection Pilot for Delegated Agent Authority

Delegated tool authority can fail when a permission check and its consequential effect observe different state. We present a small, reproducible integration pilot that measures committed effects under four authored concurrent schedules: competing requests against a shared budget, an authorized within-budget control, repeated operation identifiers, and parent-grant revocation. Two worker threads use separate real SQLite connections. A deliberately weak controller caches a preflight decision; a reference gateway rechecks the grant chain, budget, and operation identifier inside the same transaction that records the local effect. Across 80 related schedules per controller, the weak controller violates at least one invariant in 60 schedules and matches authorized completion in 20; the gateway has zero observed violations and matches authorized completion in all 80. A separate response-loss control produces two external effects under naive retry, versus one effect and one charged unresolved operation under conservative retry suppression. These results validate the measurement harness and a narrow local transaction boundary. They do not establish security for model-driven agents, distributed services, Cedar policies, or arbitrary external endpoints. We describe the stronger comparisons and failure semantics needed for that next study.