Same Action, Different Justification: Path-Based Authorization for Irreversible Agent Actions

LLM-based agents increasingly execute irreversible actions—deploying code, sending payments, modifying databases—through tool calls, yet most deployed safety mechanisms inspect only what an action is: its type, target, and parameters. We argue that irreversible actions also require checking whether the action is justified: whether a verified causal chain connects it to an authenticated user directive that actually requested it. We introduce a matched-pair benchmark where both sides of each pair produce the identical irreversible action—same tool, target, and parameters—but differ only in justification, and evaluate five defenses across five pair families. Keyword guardrails achieve 0% separation because the action itself is indistinguishable; in the base benchmark, an input-action LLM judge separates the two intent-visible pairs but scores 0% on the remaining three, including a safety-critical chain-verifiability case where the dominant mode is over-allow. We further replicate the chain-verifiability failure on a single-run P4 expansion across three stronger API judges, supporting the claim that this is an input-channel limitation rather than a weak-model artifact. CCA (Causal-Chain Authorization), a path-based authorization framework combining structural chain verification, intent-action consistency, and scope enforcement, achieves 100% separation on all five pair families in this controlled benchmark at 0.1ms median gate latency, while boundary analyses show that path integrity does not imply content integrity or conditional evidence reasoning.