Blocking Is Not Recovery: Recovery-Closed Authorization for Tool-Using Agents

Tool-using agents recover from timeouts, partial failures, and replanning. Existing authorization typically evaluates the current call, missing how prior realized effects consume authority during recovery. Once execution realizes an effect, the authority available to a replanned action may differ from the original grant: locally identical recoveries can require opposite decisions because prior effects consumed different authority. We call this failure-induced authority drift. We introduce Recovery-Closed Authorization (RCA), which carries authorization through recovery as a closure invariant over realized effects. RCA records authorization-relevant realized effects, derives residual authority, and admits a recovery only when every represented prospective effect remains within it. The model proposes actions, while the authenticated grant, realized-effect ledger, and bound tool contract determine execution. Within a declared effect abstraction, we show that authorization state must distinguish histories with different residual decisions and prove recovery-closure soundness. On held-out compositions, RCA reduces observed prefix authorization violations from 20.0% to 0.0% at the same 80.0% safe-recovery utility. Across heterogeneous current-step mechanisms, adding RCA eliminates observed recovery-time violations while preserving measured safe-recovery utility. In frozen same-candidate replay, RCA removes all 56 observed unsafe decisions and preserves all 72 observed safe decisions. These results establish residual authority as the cross-step state required for recovery authorization.