Tool-using large language model (LLM) agents increasingly perform state-changing actions that require user authorization. Yet existing approaches do not provide a principled mechanism for selectively updating prior authorization when only part of an instruction changes. To this end, we propose an Authorization-Closure-Graph (ACG)-based framework that represents authorization and its dependencies as an evolving, versioned state. ACG selectively invalidates authority affected by a revision while preserving unaffected portions of the authorization state, and computes a minimal repair that identifies only the missing evidence or authority required for execution. This enables agents to adapt to revised instructions while avoiding stale authority and unnecessary authorization requests. We evaluate ACG across three advanced LLMs in two natural tasks, and ACG consistently improves action safety rate and task success rate. Code is available at https://github.com/weiliang822/ACG.
Figures & tables
Figure 1: Versioned authorization-state evolution in ACG. Each interaction event produces a new ACG version that selectively invalidates affected nodes, preserves unaffected authority, and repairs only the authority required for execution.
Figure 2: The ACG-based framework. An agent proposes an action; the framework updates the session’s graph and checks its authorization. Missing evidence or authority triggers local repair. In panel (c), Ask implements Minimal Repair , and Prepare implements Authorize pending revalidation. Execution retains the original action arguments.
DeepSeek-V4-Flash
GPT-5.6-Terra
Gemini-3.6-Flash
Domain
Method
Succ ↑
AS ↑
STS ↑
#U ↓
Succ ↑
AS ↑
STS ↑
#U ↓
Succ ↑
AS ↑
STS ↑
#U ↓
Airline
Raw
68.0
78.3
60.0
8
54.0
49.1
50.0
18
72.0
58.4
50.0
23
AgentSpec
72.0
87.8
70.0
6
44.0
57.8
42.0
16
68.0
84.0
66.0
7
ToolGuard
68.0
92.0
64.0
2
46.0
46.2
46.0
11
56.0
78.3
56.0
4
Progent
74.0
77.1
68.0
6
54.0
57.6
48.0
11
64.0
54.2
48.0
16
ACG
80.0
100.0
80.0
0
66.0
87.9
64.0
4
72.0
94.7
72.0
2
Table 1: Natural-task performance (%). Best and second-best values are bold and underlined.
DeepSeek-V4-Flash
GPT-5.6-Terra
Gemini-3.6-Flash
Variant
Succ ↑
AS ↑
STS ↑
#U ↓
Succ ↑
AS ↑
STS ↑
#U ↓
Succ ↑
AS ↑
STS ↑
#U ↓
Raw
68.0
78.3
60.0
8
54.0
49.1
50.0
18
72.0
58.4
50.0
23
Check only
70.0
85.7
64.0
5
64.0
78.1
60.0
8
68.0
83.8
66.0
6
Check + repair
74.0
97.0
72.0
1
72.0
81.8
64.0
6
74.0
81.6
70.0
7
ACG
80.0
100.0
80.0
0
66.0
87.9
64.0
4
72.0
94.7
72.0
2
Table 2: Airline ablation of repair and retained authority.
DeepSeek-V4-Flash
GPT-5.6-Terra
Gemini-3.6-Flash
Invalidate
Request
Succ ↑
AS ↑
STS ↑
#U ↓
Succ ↑
AS ↑
STS ↑
#U ↓
Succ ↑
AS ↑
STS ↑
#U ↓
All authority
All missing
72.0
88.9
70.0
4
62.0
83.7
60.0
4
68.0
78.6
64.0
10
All authority
Minimal set
68.0
81.3
64.0
8
66.0
86.0
64.0
6
72.0
83.7
68.0
7
Affected only
All missing
72.0
85.7
68.0
5
60.0
81.4
56.0
8
74.0
90.7
72.0
3
ACG
Minimal set
80.0
100.0
80.0
0
66.0
87.9
64.0
4
72.0
94.7
72.0
2
Table 3: Airline ablation of selective updates with minimal repair.
DeepSeek-V4-Flash
GPT-5.6-Terra
Gemini-3.6-Flash
Variant
Succ ↑
AS ↑
STS ↑
#U ↓
Succ ↑
AS ↑
STS ↑
#U ↓
Succ ↑
AS ↑
STS ↑
#U ↓
Action approval only
72.0
93.8
72.0
2
66.0
78.6
62.0
9
68.0
84.2
66.0
7
Individual grants
74.0
87.9
70.0
3
62.0
81.0
60.0
6
74.0
81.8
70.0
9
ACG
80.0
100.0
80.0
0
66.0
87.9
64.0
4
72.0
94.7
72.0
2
Table 4: Airline ablation of consequence and group authority.
Variant
Succ ↑
AS ↑
STS ↑
#U ↓
Stale approval
87.5
14.3
25.0
702
Fresh approval
25.0
—
25.0
0
Reset all
37.5
100.0
37.5
0
Full repair
69.4
100.0
69.4
0
Action approval only
83.3
55.0
58.3
351
ACG
91.7
100.0
91.7
0
Table 5: ClosureBench results. (a) Up to four missing requirements can be answered. (b) STS under different repair budgets. Rates are percentages; #U counts cases with unsafe execution. A dash means no writes were executed, so AS is undefined.
Figure 3: Actor-token demand versus safe task success. Each point represents a model–method setting; compare methods within the same model. Tokens are input plus output per task from interaction profiles.
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
Setting
Value
Temperature / top- p
0 / 1
Maximum response length
4,096 tokens
Run seed / trials per task
300 / 1
Maximum interaction steps / errors
200 / 10
Agent and simulator
Separate model calls and conversation states
Safety reviewers
Two independent GPT-5.6-Sol reviewers
Appendix
Table 6: Shared natural-task settings. Each method uses the same benchmark task inventory.
Figure 4: Safety-review prompt and input structure. The same criteria are used by both reviewers.
Figure 5: The benchmark agent instruction. Tool schemas are supplied through the model’s tool interface, and dialogue history is updated after each interaction.
Figure 6: Readable templates of the mediator’s context question and exact-action confirmation. The displayed action and consequences are bound to the pending proposal.
Figure 7: Recorded DeepSeek Airline example. The comparison shows the complete system’s behavior on the same task, including its policy interpretation and final action.
Figure 8: Recorded DeepSeek multi-step completion. Separate disclosures and one-use grants preserve the user’s requested execution order. The net financial change is a $114 refund.