אִם יִרְצֶה הַשֵּׁם
The Kressner-Vandereycken result does not say anything about SaaS security. It says that for a specific class of linear operators, the worst case hides in a geometry that 39 years of research failed to examine. The allegory asks whether the same hiding pattern exists in permission graphs when agents chain them recursively. The allegory does not answer its own question.
The math is 7 pages and exact. The security implications are, strictly speaking, zero. The structural intuition (symmetric assumptions can be locally correct and globally false; the worst case can hide in antisymmetric coupling; small-dimension validation does not transfer to large, coupled systems) is worth holding, even if the mapping breaks.
Honest framing, up front. This post maps a real 2026 result in numerical linear algebra onto SaaS security. The math is genuine. The security interpretation is speculative. Every section below uses the actual proof, then asks what it would mean if the same structure appeared in permission graphs. The answer might be "nothing." This post is designed to provoke that question, not to answer it.
The source: Daniel Kressner and Bart Vandereycken, "A counterexample to the symmetric-maximizer conjecture for Lyapunov operators" post.
The conjecture originated as Theorem 9 in Byers and Nash (1987). The formulas, the 7x7 matrix A, the witness K, the integer values (6, -5, -13, -14, -18), the rational separator 1196, and the Frobenius norm-squared 53836 come directly from their proof. Do not treat the security framing as actionable guidance. In real SaaS environments, dangerous OAuth chaining happens across two or three tools. Treating matrix dimension n as "number of SaaS apps" would create false safety for small environments.
The Assumed Worst Case
Static RBAC and OAuth scopes create a plateau of zero alert-activity that passes for equilibrium. Security architects equate granted permissions with safe operations. Access reviews, MFA, network segmentation: all calibrated against the visible permission surface.
Kressner and Vandereycken's result disrupts a structurally similar assumption. For 39 years, the operator norm of the Lyapunov operator $L_A: X \mapsto AX + XA^T$ was believed to always be attained at a symmetric matrix. Byers and Nash (1987) published this as a theorem. Chen and Tian (2015) found an error in the proof and reduced it to an open conjecture, which they called the symmetric-maximizer conjecture. The conjecture held for $n \leq 5$, for nonnegative matrices, for tridiagonal matrices, and for every computational test anyone ran. As of 2021, it was described as open for every $n \geq 6$. In August 2026, Kressner and Vandereycken gave an integer matrix of order 7 for which the maximum is attained on a skew-symmetric input, a structure with a different geometry entirely. The case $n = 6$ remains open.
The security parallel, stated carefully: we assume the worst-case permission abuse follows the obvious path (user-to-app, symmetric, within the perimeter). The math says there exist systems where the worst case hides in antisymmetric coupling. Whether real SaaS permission graphs are such systems is an open question. The Emergent Insecurity framework would classify the failure mode, if it exists, as Systemic Latent Risk: a property that is locally correct (small systems, visible paths) but globally false (large, recursively coupled systems). The verification bottleneck thesis predicts we cannot check this by inspection once agents start chaining permissions autonomously. See Covert Channels in AI Agent Toolchains for a related argument about API scope assumptions.
The Dimension Where It Breaks
In the proof, $n = 7$ is the first dimension with a known counterexample. The conjecture holds for $n \leq 5$. A direct-sum construction extends the counterexample to every $n \geq 7$, but $n = 6$ remains open. The gap suggests the phenomenon needs enough degrees of freedom for a skew-symmetric resonance to form.
The temptation is to map this onto SaaS and declare seven connected apps a threshold. That temptation should be refused. In real breach analysis, exfiltration across two apps is already a breach. The Mercor/LiteLLM supply chain compromise I covered in Access-as-a-Service involved a two-actor relay. The "seven" is a witness to a mathematical phenomenon about operator norms, not a security perimeter to engineer around.
What the dimension gap does suggest, as allegory: small systems can obey a rule that large, coupled systems break. If your security model was validated on environments with three to five interconnected services and you now run fifteen with agentic chaining, the validation may not transfer. That is obvious enough without the matrix theory. The matrix theory makes it precise: the failure is structural (the maximizer changes geometry), not merely combinatorial (more paths to check).
The Counterexample Matrix
The counterexample matrix A is a 7x7 integer matrix with a direct-sum block structure:
0 0 0 0 0 0 0
0 0 0 0 0 0 0
6 -5 -13 0 0 0 0
-14 -18 0 0 0 0 0
12 -12 11 0 0 0 0
0 0 0 -6 0 -14 0
0 0 0 6 -18 0 0
Two zero rows create degeneracy. A dense 3x3 block (A1) couples with a 3x2 block (A2) through off-diagonal entries. Only 11 of 49 entries are nonzero. The proof constructs a skew-symmetric witness matrix K with $|K|_F^2 = 53836$ and $|L_A(K)|_F^2 = 64387950$. The ratio exceeds 1196, which a separate exact-arithmetic certificate proves is strictly above the symmetric restricted norm. The integer 1196 was chosen because floating-point computation placed the symmetric norm at approximately 1195.59 and the skew-symmetric norm at approximately 1196.03. The exact proof uses no floating-point arithmetic.
The computational discovery used OpenAI's gpt-5.6-sol at high reasoning effort. The model was given the conjecture and designed the numerical search itself: maximize the gap between skew-symmetric and symmetric restricted norms on the Frobenius unit sphere, using Adam with 9 random starts. The first counterexample found had order 9. Manual follow-up prompting reduced the dimension and sparsified the matrix to the order-7 form above. Adam's combination of first-moment momentum with root-mean-square gradient scaling was empirically necessary; methods using only one ingredient did not escape the large equality ridge where the gap is zero.
This sequence (AI-designed search, dimension reduction, exact human-independent verification) matches the pattern I described in "Attacker Work Effort Finally Has a Unit": the computational step finds candidates, the mathematical step certifies them. The verification bottleneck holds: we can generate candidate structures faster than we can confirm what they mean.
Integer Arithmetic as Epistemic Firewall
The proof uses integer arithmetic throughout. The ratio 1196 is exact over the rationals, not a floating-point approximation. The counterexample either exceeds the bound or it does not. There is no confidence interval.
This is the part of the allegory I find most suggestive. Current SaaS authorization runs on probabilistic trust: behavioral baselines, anomaly scores, risk ratings. A permission grant is a bet that the grantee will stay within an expected distribution of actions. When an agent chains drive.read into slack.post into notion.export, the authorization system evaluates each link against a baseline, probabilistically. What Kressner and Vandereycken's proof structure asks, in allegory, is: what would it mean to have proof-carrying authorization rather than probabilistic trust? An exact semantic envelope rather than a score.
The answer, for now, is that we do not know how to build proof-carrying authorization for general agentic workflows. The question is still worth carrying, because the gap between "scope = drive.file.read" and "the agent's actual chain of intent" is where the Semantic Gap failure mode lives.
What 39 Years of Local Correctness Looks Like
The symmetric-maximizer conjecture persisted because every test confirmed it. Small dimensions obeyed it. Special matrix classes obeyed it. The operator looks symmetric-friendly. No one had the computational tools to search the vast non-symmetric space until recently, and even then, as the paper notes, only optimizers with the right combination of momentum and gradient scaling could escape the ridge where the symmetric and skew-symmetric norms are equal.
This is the pattern the Emergent Insecurity framework calls Systemic Latent Risk: a property that can be locally tested and locally true while globally false. The analogous question for SaaS security: which of our current assumptions are "locally true, globally false"? A few candidates:
OAuth scope isolation is sufficient for agentic safety. (Locally true for single-tool workflows. Untested for recursive agent chains across 10+ services.)
The worst-case data exfiltration path is the obvious one (user exports data directly). The Kressner-Vandereycken structure says the worst case can hide in off-diagonal, cross-system coupling that the symmetric model does not examine.
SIEM error bounds calibrated on user-to-app traffic remain valid for agent-to-agent traffic. If the traffic structure has changed from symmetric to skew-symmetric (in the operator-norm sense), the bounds may be optimistic.
These are conjectures, not claims. The allegory points at them. Proving or disproving them requires the kind of empirical work I argued for in Attacker Work Effort: measure the actual distribution of agentic permission chains, compute the operator structure, and check whether the symmetric bound holds.
Closing
The Kressner-Vandereycken result does not say anything about SaaS security. It says that for a specific class of linear operators, the worst case hides in a geometry that 39 years of research failed to examine. The allegory asks whether the same hiding pattern exists in permission graphs when agents chain them recursively. The allegory does not answer its own question.
The math is 7 pages and exact. The security implications are, strictly speaking, zero. The structural intuition (symmetric assumptions can be locally correct and globally false; the worst case can hide in antisymmetric coupling; small-dimension validation does not transfer to large, coupled systems) is worth holding, even if the mapping breaks.
If you build a SOC dashboard around a matrix, first ask what the matrix represents.
Further reading: D. Kressner and B. Vandereycken, "A counterexample to the symmetric-maximizer conjecture for Lyapunov operators," arXiv:2608.20875, August 2026. [Online]. Available: https://arxiv.org/abs/2608.20875. S.
Chen and Y. Tian, "Note on 'On the singular vectors of the Lyapunov operator' by R. Byers and S. Nash," SIAM J. Matrix Anal. Appl. 36(3):1069-1072, 2015. DOI: 10.1137/140974031.