Same Action, Different Justification: Path-Based Authorization for Irreversible Agent Actions

LLM agents increasingly execute irreversible tool calls such as code deployment, payments, and database updates. Many defenses authorize these calls from endpoint-visible fields alone: tool name, target, and parameters. This paper studies a controlled matched-pair benchmark where two executions produce the same action object but differ in whether the path to that action was authorized. Endpoint-only judges resolve intent-visible pairs but remain near zero on delegated scope and chain verifiability across three API judges, while the ambiguous-intent case varies by model; the chain-verifiability failure is safety-critical because its dominant mode is over-allow. CCA supplies trusted path-side metadata for origin, delegated scope, and audit coverage, plus intent-action consistency, and separates all five pair families under the explicit assumptions of this harness at 0.1 ms median gate latency. Boundary tests mark the intended limit: path integrity does not establish content integrity inside a valid chain, and the current gate does not reason over conditional evidence.