Newest papers

Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents

Anmol Pandey, Aditya Jain, Liang Chen, Carsten Maple · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.27620 · cited by 0 works (OpenAlex) · open-access PDF

Korean

독립적 인 서명 단일 LLM 에이전트는 행동 당 권한에 따라 동일한 경보 도구를 통해 작동합니다 : 로컬 경비는 각 도구 호출을 고립적으로 스크린합니다. 우리는 로컬 권한이 글로벌 권한으로 구성되지 않는다는 것을 보여줍니다. 조성 권한 실패 (CAF)는 로컬 권한의 집행 또는 지역 권한의 한 쌍의 집행을 통해 행동합니다 : 글로벌 정책 확대 의도, 목적, 출처, 동의, 그리고 배달을 위반합니다. 우리는 CAF를 두 축을 따라 특징화합니다. (단일 흔적 보안 대 관계 k-보안) 및 관찰성 (모니터 프로파일의 계단). 우리의 중앙 결과는 불가능합니다 : 관계적 목적 위반은 2 개의 보안

Machine translation (Meta M2M100); the English original follows.

Abstract

Autonomous LLM agents act through tools under per-action authorization: a local guard screens each tool call in isolation. We show that local authorization does not compose into global authorization. A compositional authorization failure (CAF) is a locally authorized execution, or a pair of locally authorized executions, that violates a global policy spanning intent, purpose, provenance, consent, and delegation. We characterize CAFs along two axes, expressiveness (single-trace safety versus relational k-safety) and observability (a ladder of monitor profiles). Our central result is an impossibility: relational purpose violations form a 2-safety hyperproperty with no per-trace locus of blame, so a per-action monitor that never raises a false alarm detects none of them, independent of the underlying model or decision procedure; they become visible only under cross-execution monitoring, which none of the six guardrails we survey implements. We make this constructive with AL-SYNTH, a SAT/SMT synthesizer (using no language model) that emits minimal CAF witnesses, each checked against an exhaustive oracle. The empirical signature is sharp: across nine LLM judges the per-action view approves the synthesized witness almost without exception, blocking it at a rate comparable to a benign control, yet the same models flag it when shown the two executions together. Per-action authorization is therefore structurally insufficient for relational policy conjuncts not reducible to single-trace safety: to bound them, a monitor must compare executions or accept false alarms.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Guard (computer science), Computer security, Constructive, Authorization, Bridging (networking)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange