Archana Kumari

Placeholder session for confirmed speakers without an assigned session, allowing them to be pushed to Swapcard and Visit.

Nobody authorized the action. The workflow says someone did.

Vyrion is an open-source security tool that exposes and hardens authorization-integrity failures in AI agents and workflows. It targets the trust boundary before actions such as payments, infrastructure changes, and access grants. These controls support oversight and audit expectations reflected in the EU AI Act Article 14, ISO/IEC 42001, and Saudi SAMA and NCA frameworks. Vyrion shows what happens when authorization evidence itself can be forged.

The attacker needs neither the reviewer's credential nor the protected action's credential. Across the systems we evaluated, saved workflow state was often treated as authorization on resume, and modifying it was enough to let an action proceed while the audit trail attributed the decision to someone who never acted. It is escalation of effect, not access.

We call this failure class Approval-Provenance Failure (APF). Across 43 agentic-AI, durable-workflow, CI/CD, and identity-governance systems, we evaluated five attack forms: Forge, Rebind, Replay, Suppress, and Launder. Twenty-nine were classified as exposed. Vyrion was shaped by the coordinated-disclosure process with Microsoft, OpenAI, and affected project maintainers.

Vyrion operationalizes this research across fifteen adapters. On stage, we pause a real workflow, rewrite its saved authorization state, resume normally, and reach the protected action with no valid decision. Vyrion then traces the authorization boundary to the action and installs reversible execution-time enforcement backed by a signed, single-use artifact bound to that action and its arguments. We repeat the attacks: genuine decisions pass; forged, rebound, replayed, and bypassed attempts are rejected.