PORTICO: Revocable Capabilities for Secure Coding Agents

Coding agents often maintain overly broad access to tools throughout an entire task, even when a specific resource is only needed for a brief subgoal. This issue, termed "lingering authority," leaves temporary resource capabilities exposed long after their justification has passed. To mitigate this, PORTICO, a new reference monitor, introduces revocable capabilities for agents. It translates explicit task contracts into initial capabilities, grant rules, trusted closure predicates, and global deny rules. During execution, expansions are materialized as opaque, epoch-bound handles. Upon subgoal completion, PORTICO removes these handles from the agent's interface and rejects any attempts to reuse stale capabilities, preventing unauthorized side effects. Experimental results show PORTICO successfully blocks contract-forbidden effects post-closure, while a non-revoking comparator permits them, demonstrating enhanced security and scope compliance in various coding agent tasks involving file writes, git mutations, and network egress.