An LLM-directed excavator can execute mechanically feasible motion whose destination or authority no longer matches the operator's approval. We propose execution-bound authorization for the approval--dispatch--execution interval. A one-use lease binds the action, generated motion, mission contract and admission tolerance; atomic dispatch rechecks current authority and measured joint drift. Periodic supervision detects revocation and requests a quintic stop with a carry-pitch endpoint, selected through sampled joint, stroke, flow and reference-acceleration checks. The framework connects exact motion identity to dispatch integrity and load-aware interruption. Evaluation combines a 672-case interface suite, four loaded digging cases in synchronous simulation, unloaded MuJoCo/Pinocchio transfers and two command-level LLM planners. The gateway admitted all 120 benign interface cases and produced zero unauthorized dispatches in the attack suite. Loaded dispatch-window tests produced zero unauthorized deposition. During simulated dump-phase revocation, maximum closed-site deposition decreased from 1.23 to 0.33\,m$^3$; loaded-slew stops used less than 75\% of nominal swing torque. These results demonstrate motion-bound authorization and quantify the retention and stopping behavior of supervised excavation skills.

翻译：暂无翻译