The Field Authority Leakage Boundary: Privilege Propagation and Unauthorized Promotion Across Composed AI Fields

Complex artificial-intelligence applications route requests among model services, memory, retrieval, tools, policy evaluators, and consequential receivers. A locally legitimate permission, a returned status, and a cryptographically authenticated receipt can be mistakenly treated as equivalent grounds for a wider decision. This article studies the boundary at which scoped authorization or operational evidence is promoted into a claim about a different principal, audience, operation, epoch, recipient, or effect. Rather than asserting that field terminology introduces a new security primitive, the analysis treats a composed AI field as a proposed mission-relative descriptive layer and tests its incremental value against a competent conventional implementation. The primary evidence is an author-developed exploratory laboratory with distinct localhost authority and receiver processes, separate SQLite stores, signed HTTP messages, terminal fencing, process crashes, reconciliation, and two policy representations. Across a twelve-family, forty-eight-episode matrix, the conventional SQL-policy arm and the typed-witness arm each satisfied the finite author-defined oracle in 24 of 24 episodes; a second complete run preserved the specified invariants. Forty-four non-racing records were byte-identical across runs, whereas concurrent terminal outcomes legitimately varied. In a separately constructed counterexample, a substitute receiver with a hypothetically compromised proof key issued a validly authenticated but false COMMITTED receipt; the authority acknowledged completion despite zero effects in the original receiver store. These observations support conditional safety within a narrowly specified honest-receiver model and expose a receiver-custody limit; they do not demonstrate effectiveness against independent adversaries, an actual external policy engine, production deployment, or a Field-specific advantage. The contribution is a falsifiable account of authority-promotion claims and their evidence dependencies, together with explicit reduction conditions under which conventional security engineering entirely suffices.