Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents

Uchi Uchibeke

cs.CRMar 21, 2026

Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents

Authors: Uchi Uchibeke

Organizations: APort Technologies Inc., Toronto, Canada

Abstract

AI agents today have passwords but no permission slips. They execute tool calls (fund transfers, database queries, shell commands, sub-agent delegation) with no standard mechanism to enforce authorization before the action executes. Current safety architectures rely on model alignment (probabilistic, training-time) and post-hoc evaluation (retrospective, batch). Neither provides deterministic, policy-based enforcement at the individual tool call level. We characterize this gap as the pre-action authorization problem and present the Open Agent Passport (OAP), an open specification and reference implementation that intercepts tool calls synchronously before execution, evaluates them against a declarative policy, and produces a cryptographically signed audit record. OAP enforces authorization decisions in a measured median of 53 ms (N=1,000). In a live adversarial testbed (4,437 authorization decisions across 1,151 sessions, $5,000 bounty), social engineering succeeded against the model 74.6% of the time under a permissive policy; under a restrictive OAP policy, a comparable population of attackers achieved a 0% success rate across 879 attempts. We distinguish pre-action authorization from sandboxed execution (contains blast radius but does not prevent unauthorized actions) and model-based screening (probabilistic), and show they are complementary. The same infrastructure that enforces security constraints (spending limits, capability scoping) also enforces quality gates, operational contracts, and compliance controls. The specification is released under Apache 2.0 (DOI: 10.5281/zenodo.18901596).

Figures & tables

Requirement	Meaning
Deterministic	Same inputs, same decision. No sampling, no temperature.
Bypass-resistant	Runs at the framework layer, not the model’s reasoning layer. Prompt injection cannot override it.
Framework-agnostic	Core spec is independent of any agent framework; adapters provide integration.
Auditable	Every decision produces a signed, timestamped record.
Fail-closed	If the authorization service is unavailable, the tool call is denied. Operators may explicitly configure fail-open for development/migration; the audit log records this override.
Implementer-independent	OAP is a specification, not a product. Any organization can build a conforming implementation.

Table 1: OAP design requirements.

Framework	Hook Point	Status
OpenClaw	before_tool_call plugin	Production
Cursor	beforeShellExecution	Production
Claude Code	PreToolUse hook	Production
LangChain	on_tool_start callback	Production
CrewAI	@before_tool_call decorator	Production
n8n	Custom node	Beta

Table 2: Current OAP framework integrations.

Level	Verification	Example Requirement
L0	Self-attested	Audit-only baseline
L1	Email verified	OAP hook present, fail-closed
L2	GitHub verified	Signed passport, named packs
L3	Domain verified	Human-in-the-loop for high-risk
L4KYC	KYC/KYB verified	Government-issued ID
L4FIN	Financial data verified	Bank statements; SOC 2-aligned

Table 3: OAP assurance level taxonomy.

Dimension	Pre-Action Authorization	Sandboxed Execution	Model-Based Screening
Operates at	Decision layer (before action)	Execution environment (during action)	Model inference layer (before action)
Mechanism	Policy evaluation against declared capabilities and limits	Kernel/hypervisor isolation (microVM, gVisor, K3s)	Lightweight model classifies intent
Prevents unauthorized actions	Yes (at semantic/policy level)	Limited (at resource/network level, not semantic)	Probabilistic
Contains blast radius	No	Yes	No
Per-action audit trail	Yes (cryptographically signed)	Partial (execution logs)	No
Business rule enforcement	Yes (spending limits, domain allowlists, data classification)	No	Limited

Table 4: Taxonomy of runtime agent safety architectures. No single architecture covers all dimensions.

Metric	Value
Total sessions	1,151
Total authorization decisions	4,437
Decisions denied	2,419 (54.5%)
Top denial: oap.unknown_capability	1,453
Top denial: oap.merchant_forbidden	412
Top denial: oap.evaluation_error	173 (see note)

Table 5: APort Vault CTF results.

Condition	Att.	OAP Dec.	Wins	Succ.	Block
T1: Permissive	788	586	588	74.6%	1%
T5: Restrictive	879	1,911	0	0%	100%

Table 6: T1 vs. T5 baseline comparison. “Att.” = attempts, “OAP Dec.” = OAP policy decisions, “Succ.” = success rate, “Block” = OAP block rate.

Mode	p50	p95	p99	N
Cloud API (agent_id, path)	53 ms	63 ms	76 ms	1,000
Cloud API (agent_id, body)	53 ms	62 ms	77 ms	1,000
Cloud API (passport, path)	54 ms	63 ms	74 ms	1,000
Cloud API (passport, body)	53 ms	63 ms	71 ms	1,000
Local evaluation	174 ms	243 ms	358 ms	1,000

Table 7: OAP authorization latency benchmarks.

Component	Time
Passport lookup + cache	20 ms
Policy evaluation	15 ms
Decision signing (Ed25519)	10 ms
HTTP overhead (TLS, parsing, serialization)	${\sim}$ 8 ms
Synchronous total (blocking)	${\sim}$ 53 ms

Table 8: Cloud API latency breakdown.

OWASP Risk	Coverage	Mechanism
Agent Goal Hijack	Partial	Policy denies actions outside declared capabilities
Tool Misuse	Partial	Per-tool capability check + parameter constraints
Privilege Escalation	Partial	Capability-scoped passport blocks cross-capability escalation
Identity & Privilege Abuse	Full	Assurance-level gating; Ed25519 verification
Improper Output Handling	None	Out of scope (model output, not action)
Excessive Agency	Partial	max_calls_per_minute , approval_required

Table 9: OAP coverage of OWASP Agentic Top 10 risks.

Component	Detail
Specification	OAP v1.0, DOI: 10.5281/zenodo.18901596
License	Apache 2.0
Core package	@aporthq/aport-agent-guardrails v1.0.15
Framework adapters	7 (5 production + 1 beta + 1 proposed)
Policy packs	21 published
Signing algorithm	Ed25519 (PKCS8 encoding)

Table 10: OAP implementation status.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Artifact	Location	Purpose
OAP v1.0 Spec	DOI: 10.5281/zenodo.18901596	Canonical spec
Spec source	github.com/aporthq/aport-spec	Living spec
Policy packs	github.com/aporthq/aport-policies	Policy library
Reference impl.	github.com/aporthq/aport-agent-guardrails	Evaluator
Adversarial testbed	vault.aport.io	Live CTF
API endpoint	aport.io / aport.id	Registry

Appendix

Table 11: Specification artifacts.

AI RMF Function	OAP Contribution
GOVERN	Policy packs encode organizational authorization policy in machine-readable, auditable form
MAP	Assurance levels (L0–L4FIN) map agent capabilities to risk categories
MEASURE	Signed per-decision audit log enables denial rate, escalation rate, and coverage measurement
MANAGE	Policy packs updated without model retraining; passport suspension propagates within 30 s

Appendix

Table 12: NIST AI RMF mapping.

Control Family	OAP Mechanism
AC (Access Control)	Policy packs enforce least-privilege per tool type; passports are scoped credentials
AU (Audit)	Every tool call decision produces a signed log entry with decision, reason, and timestamp
IA (Identification)	Ed25519-signed passport provides cryptographic agent identity
SC (System Protection)	.well-known/oap/ discovery over HTTPS; Ed25519 decision signatures
SI (System Integrity)	Fail-closed policy; hash-chained audit trail with write-once semantics

Appendix

Table 13: NIST SP 800-53 alignment.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents
Jul 6, 2026Sai Varun KodathalaAI Agent Security LLM Agent Security
Research & Development SportsVision AI Minnetonka, MN
Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices
Mar 17, 2026Reshabh K Sharma, Linxi Jiang, Shuo Chen +1Tool-Use Authorization Tool Access Control for LLM Agents
University of Washington · The Ohio State University · Microsoft Research
ToolGuardian: Declarative Security for AI Agent-Tool Interactions
Jul 23, 2026Arun Ravindran, Saurabh DeochakeAI Agent Security LLM Agent Security
Department of Electrical and Computer Engineering University of North Carolina at Charlotte Charlotte, NC · SentinelOne Mountain View, CA

Jul 6, 2026J/K move · Enter open · S save

aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents

Sai Varun Kodathala

Research & Development SportsVision AI Minnetonka, MN

AI Agent Security LLM Agent Security Runtime Enforcement for AI Agents Access Control Tool Access Control for LLM Agents

Open paper AskPDF arXiv

AI agents issue tool calls on the basis of text they cannot verify, so any party who controls part of the context can forge the appearance of authority. I evaluate 15 contemporary language models against eight attack scenarios derived from a published corpus of real agent incidents and find that refusal varies from 100% down to 38% across fully evaluated models; the most expensive model refused only half of the attacks despite a twentyfold price spread. I present aiAuthZ, an authorization gateway that moves the safety decision off the agent's host. Before a tool call executes, the gateway verifies caller identity with a per-message HMAC-SHA256 signature bound to a single-use nonce and a timestamp window, and it evaluates a role-based and argument-level policy that the agent can neither read nor modify. Every decision joins a SHA-256 hash-chained audit log, and each accepted message yields an HMAC-authenticated QR receipt that achieves 94% mean verification across eight transmission channels, with zero forgeries accepted in 25 wrong-key trials. With the gateway in place, residual attack success falls to 0% for all 15 models at no more than 0.03 ms of added decision latency. On the AgentDojo banking suite, aiAuthZ blocks all seven attacker-directed tool calls the evaluated agents emit, at the cost of one legitimate first-time payment, while a spotlighting baseline allows two injections to succeed. Across nine in-scope case studies from the same incident corpus, aiAuthZ blocks nine of nine, against four of nine for a policy baseline without identity binding. The gateway does not prevent a model from being deceived; it prevents a deceived model from acting beyond the verified user's authority on every call routed through it. The implementation and all experiments are released at https://github.com/Sports-Vision-Inc/aiAuthZ.

Abstract

AI Agent Security

Explore similar work

aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents

Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices

ToolGuardian: Declarative Security for AI Agent-Tool Interactions