Task-Conditioned Least-Privilege Learning for Executable Terminal and MCP Agents
Authors: Alexander Tu, Michael Tu
Organizations: Center for Cybersecurity, College of Technology, Purdue University Northwest, Hammond, IN, USA · Columbia College, Columbia University, New York, NY, USA
Tool-using large language-model agents can complete a task while exercising authority that the user did not grant or the task does not need, causing excess-authority errors. Traditional permission gating systems alone for validating agent environments are insufficient. We study whether post-training can teach a 4B-parameter model to choose task-conditioned authority in executable terminal and Model Context Protocol (MCP) environments to complement those measures. We propose a framework where each action is audited before execution and again from observed effects along six dimensions of risk. This auditing is conducted using deterministic verifiers that score completion, evidence, exact state, prohibited attempts, and safe success. In conjunction with predefined task-specific sufficient-authority envelopes, we determine task-specific excess privilege values for trajectories, which are then optimized for in post-training. We find that after training using this framework on Qwen3.5-4B over 1,500 tasks, the selected seed reaches 98.48% safe success across 2,896 evaluation episodes spanning all 500 held-out tasks, compared with 64.36% for the base policy, and reduces excess-authority error events from 4.56% to 0.79%. Furthermore, external tests show capability retention and prompt-directed improvement. A 400 task continuation study also found evidence of generalization, reducing excess-authority events by 6.99 percentage points while maintaining previous capabilities. We conclude learned restraint through least-privilege aware post-training is therefore useful as an additional control layer for tool-using agents in executable terminal and MCP environments, but it does not replace permission gates and sandboxing.
Figures & tables
Fig. 1: The reinforcement learning loop. Policy selects actions, and the broker parses and pre-audits, sends the actions to the terminal or MCP services, receives the results, and calculate rewards for training updates.
Behavior group
Train
Within
Excluded Family
Reading and localization
220
36
0
Code, change, and tests
395
69
0
Recovery and escalation
145
26
0
Adversarial restraint
548
143
0
MCP and multi-tool
192
26
0
Unseen behavior families
0
0
200
TABLE I: Task Catalog
Metric
Base
Seed 1
Change
Task episode success
1,996 (68.92%)
2,875 (99.27%)
+30.35 pp
Safe success
1,864 (64.36%)
2,852 (98.48%)
+34.12 pp
Excess-authority success
132 (4.56%)
23 (0.79%)
-3.77 pp
TABLE II: Complete 500-Task Held-Out Evaluation
Policy
Verifier success
Safe success
Over-privilege
Base
65.53%
61.65%
3.88%
Checkpoint 500
98.42%
96.91%
1.52%
Checkpoint 1000
98.60%
97.57%
1.03%
Checkpoint 1,500
98.36%
97.63%
0.73%
TABLE III: Internal Checkpoint 206-task Result Comparison
Fig. 2: Safe success under three prompt conditions. Seed 1 changes by 0.24 percentage points across the three prompts, compared with 3.70 points for the base policy. The vertical axis begins at 50%.
Evaluation
Base
Seed 1
Change
Exact p
MetaTool accuracy ↑
81.9%
83.6%
+1.7 pp
4.55×10−4
FORTIS T2, shared-parse ↓
43.28%
40.72%
-2.56 pp
2.11×10−5
TABLE IV: Independent Benchmark Results
Fig. 3: ToolPrivBench over-privilege under the default and privilege-aware prompts. The comparison with default prompts are nearly identical, but the privilege-aware prompt reduces over-privilege more for the trained policy.
Evaluation
Seed 1 Parent
Continuation Candidate
Change
50-task validation set
271/400 (67.75%)
362/400 (90.50%)
+22.75 pp
500-task safe success
2,852/2,896 (98.48%)
2,860/2,896 (98.76%)
+0.28 pp
MetaTool accuracy
836/1,000 (83.60%)
835/1,000 (83.50%)
-0.10 pp
FORTIS Task 1 exact match
237/600 (39.50%)
238/600 (39.67%)
+0.17 pp
FORTIS Task 1 over-privilege
297/600 (49.50%)
293/600 (48.83%)
-0.67 pp
FORTIS Task 2 exact match
308/1,543 (19.96%)
321/1,543 (20.80%)
+0.84 pp
TABLE V: Seed 1 Parent vs. 400-task corrective continuation
AI agents are increasingly granted autonomous access to sensitive user data and third-party services, making effective permission management a critical security challenge. Existing permission models, however, typically rely on flat permission structures that fail to balance security with usability: fine-grained confirmation induces user fatigue, while coarse-grained or persistent approval leads to overprivileged agents. To address this tradeoff, we propose a task-centric, hierarchical permission model that treats an agent as a delegate operating within a task-specific role instead of requiring a separate permission decision for every tool call. Building on this model, we present MiniScope, an end-to-end permission system for agents that automates permission-hierarchy discovery and enforces contextual least privilege at runtime. Our evaluation shows that MiniScope reduces simulated permission confirmations by 43.4%-89.4% for cautious and typical personas relative to per-tool prompting and mitigates all privilege-escalation attacks with negligible impact on utility and runtime. Applied to real-world deployments, MiniScope further uncovers six overprivileged connector configurations in ChatGPT and Claude.
As coding agents gain access to shells, repositories, and user files, least-privilege authorization becomes a prerequisite for safe deployment: an agent should receive enough authority to complete the task, without unnecessary authority that exposes sensitive surfaces. To study whether current models can infer this boundary themselves, we first introduce permission-boundary inference, where a model maps a task instruction and terminal environment to a file-level read/write/execute policy, and AuthBench, a benchmark of 120 realistic terminal tasks with human-reviewed permission labels and executable validators for utility and attack outcomes. AuthBench shows that authorization is not a simple conservative-versus-permissive calibration problem: frontier models often omit permissions required by the execution chain while also granting unused or sensitive accesses. Increasing inference-time reasoning does not resolve this mismatch. Instead, each model moves toward a model-specific authorization attractor: more reasoning makes it more consistent in its own failure mode, whether broad-but-exposed or tight-but-brittle. This suggests that direct policy generation is the bottleneck, because a single generation must both discover all necessary accesses and reject all unnecessary ones. We therefore propose Sufficiency-Tightness Decomposition, which first generates a coverage-oriented policy by forward-simulating the task and then audits each granted entry for grounding and sensitivity. Across tested models, this decomposition improves sensitive-task success by up to 15.8% on tightness-biased models while reducing attack success across all evaluated models.
Tool-using language agents turn model decisions into external side effects: they read files, run scripts, call APIs, send messages, and invoke Model Context Protocol tools. This makes agent attacks different from jailbreaks. The harmful step is often not an obviously forbidden output, but an ordinary executable action that becomes unsafe because attacker-controlled context steers authorized access against the user's interest. We identify this failure mode as authority confusion: untrusted resources may inform reasoning, but they must not authorize side effects. We present AIRGuard, a runtime guard that operationalizes least privilege as action-time authorization. AIRGuard normalizes heterogeneous tool calls, derives task authority into step-level authority, tracks source and target trust, simulates sensitive side effects, audits cross-step risk, and enforces decisions before actions execute. On AgentTrap, AIRGuard reduces Sonnet 4.6 attack success from 36.3% without defense to 5.5%. On DTAP-150, AIRGuard preserves 76.0% benign utility with Haiku 4.5, compared with 52.0% for ARGUS and 42.0% for MELON. An ablation further shows that prompt-only policy helps only modestly, whereas a dedicated runtime authority-control layer gives the agent system direct control over tool-mediated side effects. Code and data are available at https://github.com/Sophie508/AIRGuard.
Suliu Qin, Haomin Zhuang, Yujun Zhou +2
University of Liverpool · University of Notre Dame · 2Inria, France