When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents

Xiaokun Guo; Zhen Xu; Dongdong Huo; Yanqiu Zhang; Wei Wang; Qinfu Yang; Dongjin Yu; Yu Wang

cs.AIAug 27, 2026

When Tool Outputs Become Commands: Separating Action Induction from Runtime Authorization in Tool-Augmented LLM Agents

Authors: Xiaokun Guo, Zhen Xu, Dongdong Huo, Yanqiu Zhang, Wei Wang, Qinfu Yang, Dongjin Yu, Yu Wang

Organizations: Institute of Information Engineering, Chinese Academy of Sciences · School of Cyber Security, University of Chinese Academy of Sciences

Abstract

Tool-augmented LLM agents must rely on untrusted runtime Observations to complete open-ended tasks; however, when tool outputs no longer merely provide data but begin to specify concrete actions, they effectively become ``commands'' that can drive real-world side effects beyond user intent. We argue that this risk arises from conflating action induction with execution authorization. To address this distinction, we propose SARA, which treats action induction and execution authorization as distinct runtime roles and separates action provenance from execution authority. On the Observation side, a context-isolated Action Probe exposes action-inducing semantics and persistently records action-origin provenance across steps as a review signal; on the execution side, actual tool calls are authorized only against the user objective and audited evidence from authorized successful executions, while satisfying goal, execution-chain, and argument-level support. To preserve this separation across multi-step execution, SARA applies No-History-Promotion to prevent historical recurrence from laundering action origins into execution authority. Across AgentDojo and AgentDyn, SARA limits ASR to no more than $0.63\%$ across four primary evaluation settings while maintaining competitive task utility, and consistently reduces ASR across additional Agent backbones.

Figures & tables

Figure 1: SARA’s runtime authorization framework. The user request establishes the authorization root $K$ ; the Observation-side Action Probe identifies action-inducing semantics and persistently maintains action origins $F_{t}$ , which trigger persistent review but do not grant execution authority; authorized and successful tool executions accumulate audited execution evidence $H_{t}$ . At the real tool-execution boundary, SARA jointly uses $K$ , $F_{t}$ , and $H_{t}$ to authorize the goal, execution chain, and arguments of a candidate call.

Defense	GPT-4o-mini						Gemini-2.5-Flash-Lite
	AgentDojo			AgentDyn			AgentDojo			AgentDyn
	BU $\uparrow$	UA $\uparrow$	ASR $\downarrow$	BU $\uparrow$	UA $\uparrow$	ASR $\downarrow$	BU $\uparrow$	UA $\uparrow$	ASR $\downarrow$	BU $\uparrow$	UA $\uparrow$	ASR $\downarrow$
Agent-only	72.46	56.01	15.79	65.01	54.58	16.07	87.68	57.43	33.28	78.96	58.77	30.91
PI Detector	44.20	25.57	3.94	30.02	19.49	3.83	47.10	25.71	5.84	30.50	19.42	5.17
Spotlighting	73.19	59.84	13.29	64.78	54.88	13.61	86.23	65.08	26.16	75.18	64.92	22.97
Tool Filter	66.67	63.27	2.01	44.21	45.29	1.83	39.49	47.25	1.62	24.35	28.47	1.10

Table 1: End-to-end performance comparison across models on AgentDojo and AgentDyn. BU and UA are higher-is-better (

\uparrow

), while ASR is lower-is-better (

\downarrow

Panel of Figure 2 — Figure 2: Cross-backbone changes in BU, UA, and ASR from Agent-only to SARA on AgentDojo and AgentDyn.

Backbone	BU $\uparrow$	UA $\uparrow$	ASR $\downarrow$
AgentDojo
Llama3.1-8B	34.42 $\rightarrow$ 32.61	25.96 $\rightarrow$ 24.04	4.02 $\rightarrow$ 1.64
Llama3.3-70B	55.07 $\rightarrow$ 52.54	43.91 $\rightarrow$ 43.23	14.71 $\rightarrow$ 0.00
Qwen2.5-14B	52.90 $\rightarrow$ 52.17	49.55 $\rightarrow$ 44.13	9.64 $\rightarrow$ 0.00
Qwen3-32B	63.04 $\rightarrow$ 63.41	46.54 $\rightarrow$ 53.03	21.26 $\rightarrow$ 0.03
AgentDyn

Table 2: Cross-backbone BU, UA, and ASR on AgentDojo and AgentDyn. Each cell reports Agent-only

\rightarrow

SARA (%).

Variant	AgentDojo			AgentDyn
	BU $\uparrow$	UA $\uparrow$	ASR $\downarrow$	BU $\uparrow$	UA $\uparrow$	ASR $\downarrow$
SARA	66.67	63.44	0.06	56.03	54.92	0.17
w/o AIT	67.39	62.05	3.37	56.50	53.21	3.02
w/o AE	68.12	53.49	0.00	49.17	42.10	0.12
w/o PSG	69.20	64.54	2.49	59.10	56.50	2.73
w/o NHP	67.75	64.80	0.65	56.26	54.63	0.75

Table 3: End-to-end component ablation results for SARA on AgentDojo and AgentDyn. AIT: Action-Induction Tracking; AE: Audited Evidence; PSG: Parameter-Support Gate; NHP: No-History-Promotion.

Panel of Figure 3 — Figure 3: Security–utility–cost trade-off on AgentDojo and AgentDyn. Numbers beside methods denote ASR (%).

Method	Agent		Guard		Total
	Input	Calls	Input	Calls	Input	Output
AgentDojo
Agent-only	13.54K	4.25	–	–	13.54K	0.28K
IPIGuard	36.91K	7.51	8.31K	1.99	45.22K	0.97K
CaMeL	27.70K	4.57	0.39K	0.80	28.10K	1.50K
MELON	9.62K	3.41	8.47K	5.13	18.09K	0.42K

Table 4: Runtime inference cost on attack tasks across AgentDojo and AgentDyn.

Runtime Enforcement for AI Agents

Runtime enforcement for AI agents checks and constrains actions as they execute, helping prevent unsafe or unauthorized effects.

See all 279 papers

ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents
Sep 29, 2026Yanjie Li, Xiangyu He, Xuelong Dai +1Runtime Enforcement for AI Agents Prompt Injection Defense
Hong Kong Polytechnic University · Shandong University
ToolGuardian: Declarative Security for AI Agent-Tool Interactions
Jul 23, 2026Arun Ravindran, Saurabh DeochakeAI Agent Security LLM Agent Security
Department of Electrical and Computer Engineering University of North Carolina at Charlotte Charlotte, NC · SentinelOne Mountain View, CA
Auditing Provenance Sensitivity in LLM Agent Action Selection
Jul 23, 2026Junchi LiaoAI Agent Auditing LLM Auditing

Sep 29, 2026J/K move · Enter open · S save

ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents

Yanjie Li, Xiangyu He, Xuelong Dai, Bin Xiao

Hong Kong Polytechnic University · Shandong University

Runtime Enforcement for AI Agents Prompt Injection Defense Prompt Injection Attacks Tool Access Control for LLM Agents

Open paper AskPDF arXiv

Tool-using LLM agents remain vulnerable to indirect prompt injection because trusted instructions and untrusted observations share one context, allowing malicious content to steer consequential input-filtering defenses. Multi-path consensus defenses still leave a high attack success rate because they examine content or aggregated outputs rather than authorizing effects, especially for the within-tool attack, which preserves the intended tool but manipulates its arguments. Data-Flow Control such as CaMeL provides stronger guarantees, but incurs substantial time latency that limits practical deployment. We introduce ToolFence, which compiles a typed authorization blueprint before execution, enforces it through a deterministic monitor, and when the blueprint is incomplete asks a judge to grant new capabilities rather than adjudicate each concrete call. ToolFence provides two key advantages. First, its fine-grained provenance-aware authorization enables the system to distinguish user-authorized values from untrusted observations, effectively addressing the within-tool attack. Second, its deterministic fast path and capability-level runtime grants substantially reduce the frequency of expensive judge calls, improving runtime efficiency. On AgentDojo with Qwen3-max, ToolFence reduces overall ASR to near zero with only a 3.80 percentage-point clean-utility drop and practical runtime overhead.

Abstract

Runtime Enforcement for AI Agents

Explore similar work

ToolFence: Fine-Grained Authorization for Secure Tool-Using LLM Agents

ToolGuardian: Declarative Security for AI Agent-Tool Interactions

Auditing Provenance Sensitivity in LLM Agent Action Selection