Sovereign Execution Brokers: Enforcing Certificate-Bound Authority in Agentic Control Planes

Sovereign Execution Brokers: Certificate-Bound Authority Enforcement for Agentic Control Planes

This arXiv paper introduces the Sovereign Execution Broker (SEB), a runtime enforcement boundary that separates proposal, admission, and execution phases for autonomous agents operating in cloud and infrastructure environments. SEB consumes certificates from a companion Sovereign Assurance Boundary (SAB), verifies mutations against certified execution contracts, mints scoped short-lived identities, and produces signed audit records. The architecture addresses a gap in existing access-control and assurance systems by providing a mandatory enforcement point at the moment of infrastructure mutation. A prototype is evaluated on AWS and Kubernetes, measuring latency, revocation propagation, drift detection, and fault-injection security.