Research / GPL-TR-2026-02

The Chain of Intent

Tracing execution across humans and agents.

What do interaction traces reveal, and conceal, about who is acting?

Author
GrayPass
Version
GPL-TR-2026-02
Date
9 July 2026
Read the full report

Finding

Execution is observable. Authorization requires provenance.

Behavior is for anomaly. Provenance is for authorization.

Traces can sometimes show how an action was executed. They cannot show whether it was authorized. Near-perfect in-distribution agent detection turns out to be reading implementation artifacts: remove them, hold out unfamiliar tools, or replay recorded human motion, and it collapses. Applied to real sessions where a different human operates someone else's account, an automation detector flags none of them. The report proves authorization is not identifiable from the trace, then specifies the signed, scoped, revocable provenance that could carry it.

Visual analysis

01 / Execution

Human versus bot hides several different questions.

The generator spectrum makes execution style visible. The agency ontology then separates properties that may appear in a trace from properties that require external evidence.

FIG. 1Six openly specified automation families

Generator definitions · no result metric

The controlled spectrum runs from simple straight and axis-aligned motion through smooth synthesized paths to replay assembled from recorded human motion. The drawings show the specified path forms, not sampled traces.

FIG. 2Agency is not one binary label

Agency ontology · no data plotted

Execution-facing properties can leave traces. Goal origin, supervision, and authorization can vary while the visible execution stays fixed, so they require evidence outside the behavioral trace.

02 / Artifact dependence

The detector is reading the tool.

Near-perfect in-distribution separation survives almost intact when the model sees implementation artifacts alone.

FIG. 3In-distribution separation by feature regime

Balabit traces + six specified generators

0.981Balabit traces + six specified generators

All-feature in-distribution session AUC

99.3%Balabit traces + six specified generators

Of all-feature separation retained by artifacts alone

Naive and humanized generator families are perfectly separated in every regime. Replay is harder, especially after timing and precision artifacts are removed. The pooled result stays high because five generator families remain easy to distinguish.

03 / Transfer

Change the tool and confidence collapses.

Cross-family evaluation exposes tool-specific signatures. Replayed human motion establishes the hardest transfer case.

FIG. 4Train on one family, test on another

Balabit traces + six specified generators

Matrix protocol: Balabit traces + six specified generators

0.963Balabit traces + six specified generators

Mean same-family AUC

0.625Balabit traces + six specified generators

Mean cross-family AUC

0.000Balabit traces + six specified generators

Minimum cross-family AUC

Leave replay out of training

0.500 is chance · leave-one-family-out protocol

All features0.507Balabit traces + six specified generators
Artifacts only0.439Balabit traces + six specified generators
Shape only0.571Balabit traces + six specified generators
Kinematic only0.598Balabit traces + six specified generators
Each card is one training family; its rows are held-out test families. Artifact signatures can reverse across tools, producing AUC below chance. Shape features transfer across five generated-motion families, but remain weak against replayed human motion.

04 / Authorization blindness

A strong automation detector can miss the relevant mismatch.

Real human traces remain human traces when a different person operates the account. Execution mode and account identity answer different questions.

FIG. 5Automation detection is blind to account mismatch

Balabit labelled test split · 685 sessions

0 of 685Balabit labelled test split · 685 sessions

Human sessions flagged by the all-feature automation detector

366Balabit labelled test split · 685 sessions

Account-match sessions in the labeled test split

319Balabit labelled test split · 685 sessions

Account-mismatch sessions in the labeled test split

The labelled test split contains genuine human motion under both account-match and account-mismatch labels. The automation detector flags none of the 685 sessions. An identity detector separates the groups partly, but identity mismatch is not itself proof of missing authorization.

05 / Limit

Authorization is not a function of the trace.

The same visible execution can occur with or without valid delegation. That missing fact must be carried by provenance.

FIG. 6Two worlds, one observable trace

Observational-equivalence argument · no data plotted

Principal and agent identity
Delegated scope and time window
Supervision mode and approvals
Revocation status and signed receipts
If authorization can change while execution stays fixed, two worlds can produce the same observable trace with opposite authorization states. No trace-only rule can distinguish those worlds universally.
Behavior is useful for anomaly triage. Authorization needs signed, scoped, and revocable evidence connected to the action.

Report conclusion

Execution is observable. Authorization requires provenance.

Method

Read the abstract and method summary

As automated agents begin to act inside human interfaces, services increasingly want to answer two different questions from one interaction trace: how was this action executed, and was it authorized. We argue these are categorically distinct, and we separate them empirically and formally. First, we give an agency ontology that decomposes human versus bot into six axes (executor, actuation, assistance, goal origin, supervision, and authorization) and show that only the execution-facing axes are candidates for trace-based inference. Second, using a benchmark corpus of real human mouse dynamics and six openly specified automation generators spanning a naive-to-humanized spectrum, we show that a transparent human-versus-automation detector separates classes almost perfectly in-distribution (session AUC 0.98), that this performance is essentially attributable to implementation artifacts (an artifact-only detector retains 99.3% of the full AUC), and that it transfers poorly: artifact detectors anti-transfer across automation families (off-diagonal AUC as low as 0.00), and no feature regime detects a family that replays recorded human motion (leave-one-family-out AUC 0.44 to 0.60). Third, on the same real traces we show that a strong automation detector is blind to human sessions with an account and operator identity mismatch; it flags 0 of 685 labelled sessions (AUC 0.42), while a per-user identity detector only partially separates them (AUC 0.86) and still does not observe authorization. Fourth, we prove that authorization is not identifiable from the trace: whenever authorization can vary while execution is held fixed, there exist observationally identical traces with opposite authorization. We close with a delegation-evidence requirements framework and a coverage analysis against published standards, arguing that trustworthy delegation needs provenance infrastructure, not better behavioral classifiers.

  • An agency ontology separating executor, actuation, assistance, goal origin, supervision, and authorization, and which axes are candidates for trace-based inference.
  • An artifact-dependence and cross-family transfer study built from benchmark human traces and openly specified automation generators.
  • A demonstration of authorization blindness on real traces: automation detection contributes nothing to finding unauthorized human use.
  • A formal observational-equivalence result: no trace-only test can universally determine authorization. The limit is epistemic, not computational.
  • A delegation-evidence requirements framework with a coverage analysis of OAuth token exchange, JWT, capability systems, MCP, A2A, X.509, and transparency logs.

Evidence and sources

  • Balabit Mouse Dynamics Challenge

    65 owner sessions across 10 accounts, plus the labelled test split: 685 human sessions (366 legal, 319 identity-mismatch).

    Real human motion for detection baselines and the authorization-blindness experiment.

  • Six openly specified automation generators

    Linear and grid (naive); bezier, minimum-jerk, WindMouse (humanized); replay (stitched real human motion). 360 seeded sessions emitting the same event schema.

    A controlled naive-to-humanized spectrum; replay marks the behavioral-detection floor.

Limitations

  • One modality (remote-desktop mouse dynamics) and synthetic automation: the generators model a spectrum, not a census of deployed tools, so transfer findings are stated conditionally.
  • The Balabit illegal label denotes identity mismatch, genuine human motion from a different person, not a documented authorization violation. That isolation is the point, and the boundary is stated.
  • The replay control is intentionally a best case for the adversary; it establishes a floor, not a typical case.
  • The identity detector's AUC speaks to identification; the authorization claim rests on the formal result plus identity being neither necessary nor sufficient.

Not claimed

  • Automation is not equated with malice, agent identity with principal identity, detectability with disclosure, or classification with authorization.
  • Behavioral detectors remain useful for anomaly triage; the claim is about what they can certify.
  • No new wire protocol or standard is proposed. A requirements artifact and coverage analysis, not an adopted specification.
  • No novel evasion technique is published; the generators are well-known, openly specified motion models.

Reproducibility

All code, generators, cached results, and figures are deterministic (seed 42). No proprietary detector, feature list, trace, or attack result from any GrayPass system enters the analysis.

Citation

GrayPass (2026). The Chain of Intent: Tracing Execution Across Humans and Agents. GPL-TR-2026-02. https://www.graypass.org/research/the-chain-of-intent

Continue the work

Read the complete paper, then follow the next question.

The PDF contains the complete method, secondary results, limitations, references, and publication record.

Read GPL-TR-2026-02Next: Attention Beyond Activity