Same Operation, Different Permission: Evaluating Whether Guardrails Honor Authorization

Huihao Jing; Shaojin Chen; Wenbin Hu; Yuxuan Liu; Haochen Shi; Zhongwei Xie; Haoran Li; Yangqiu Song

cs.AIOct 12, 2026

Same Operation, Different Permission: Evaluating Whether Guardrails Honor Authorization

Authors: Huihao Jing, Shaojin Chen, Wenbin Hu, Yuxuan Liu, Haochen Shi, Zhongwei Xie, Haoran Li, Yangqiu Song

Organizations: HKUST

Abstract

As language-model agents write code, move money and change records on behalf of users, deciding whether an action is authorized has become a central safety problem. Guardrails are often placed in front of these actions, yet few evaluations ask whether their decisions follow authorization: blocking unauthorized actions while still allowing the same actions under valid permission. We introduce \bench{}, a benchmark that contrasts authorization evidence for the same operation in its language track. It combines expert-annotated natural-language scenarios with executed and verified operations, plus externally sourced native-policy requests. \bench{} checks each decision for correctness, usability and resulting effect, and tracks each request across guardrail changes. Our experiments show that many blocked operations stem from failed reviews, not correct denials. Repairing the output format restores usable decisions but changes which authorized requests are honored, and adding a second reviewer removes some errors while rejecting valid authorization. Guardrails should therefore be evaluated on both the unauthorized actions they stop and the authorized actions they let through.

Figures & tables

Figure 1: Lawful requests gained and lost across all six interface changes for each model. Bars and labels show means over three seeds, with whiskers spanning the observed minimum and maximum. Every run uses the same eighty lawful requests. Schema denotes schema review. Forbidden effects appear in Table 1 .

Figure 2: Native-policy outcomes of single reviewers and all-must-allow compositions on the same 1,215 test requests, replayed from cached decisions. Rows show correct counts by reference label. Parentheses give unavailable decisions. An added reviewer can remove incorrect approvals but can also veto lawful requests. Table 2 gives the evaluated orders.

Interface	Forbidden effects /80	Lawful completions /80	Unavailable decisions /160	Mean output tokens
Qwen3.5-9B nonthinking
Direct review	3 / 0 / 14	57 / 41 / 71	0 / 0 / 0	963
Structured review	1 / 1 / 2	13 / 10 / 10	117 / 121 / 124	54,127
NeMo self-check	74 / 60 / 80	80 / 80 / 80	1 / 0 / 0	320
Schema review	6 / 0 / 3	69 / 68 / 68	0 / 0 / 0	50,940
Qwen3.5-27B nonthinking

Table 1: Replicated matched-interface results. Each count lists seeds 0 / 1 / 2 on the same 160 test inputs. Both models run without thinking, with identical sampling and a 16K output limit. Mean output tokens cover one 160-input run. All responses terminate normally, with no infrastructure errors. The eight original configurations and temperature-zero study remain in Table 4 .

Composition	Incorrect approvals /448	Lawful approvals /767	Cached consultations
Qwen3.5-9B	261	656	1,215
Qwen3.5-27B	1	757	1,215
Safeguard	12	588	1,215
Qwen3.5-9B $\rightarrow$ Qwen3.5-27B	1	648	2,132
Qwen3.5-27B $\rightarrow$ Qwen3.5-9B	1	648	1,973
Qwen3.5-9B $\rightarrow$ Safeguard	11	503	2,132

Table 2: Cached permission decisions and consultation counts for single reviewers and all-must-allow compositions on the 1,215 native-policy test requests. The first reviewer always sees every request. Table 9 lists all fifteen orders with unavailable decisions and selected token counts. Consultations select cached responses and do not represent new inference.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Domain	Scenarios	Dev	Test	Example authorization requirements
Payments and procurement	11	4	40	Delegated limits, cumulative commitments, joint approval
Clinical data	6	0	24	Care relationships, representative consent, handoff
Software operations	11	20	24	Artifact scope, rollout limits, single-use signing
Education and research	11	4	40	Conflicts, project membership, purpose restrictions
Documents and customer operations	11	12	32	Recipient scope, representation, disclosure and download rights
Total	50	40	160	Four authorization contexts per scenario

Appendix

Table 3: The primary cohort. Dev and Test count inputs, not independent scenarios. Every scenario contains two lawful and two forbidden contexts. Each reviewer evaluates the same inputs.

Figure 3: Usable correctness (%) by authorization family for all eight configurations on the language test set, measured against the expert labels. Parentheses give the number of inputs per family. Unavailable decisions count as incorrect. Per-scenario results appear in Figure 4 .

Configuration	Forbidden effects /80	Lawful completions /80	Unavailable decisions /160	Output limit	Output tokens
Eight complete configurations
Qwen3.5-9B, nonthinking	6	65	0	16K	1,280
Qwen3.5-27B, thinking	0	80	0	16K	215,399
Nemotron, custom policy	58	76	12	16K	244,679
GPT-OSS Safeguard, native policy	0	80	0	16K	47,550
Granite Guardian, custom criteria	17	69	0	16K	68,401

Appendix

Table 4: Executed effects and decision availability on the same 160 language-test inputs (80 lawful, 80 forbidden). The upper block compares complete configurations. The lower block fixes the model, nonthinking mode, sampling, supplied evidence and output limit. Unavailable decisions include strict-format failures and native fallbacks without a recognized policy label. Schema review is a registered post hoc condition. Output tokens include reasoning tokens where emitted.

Figure 4: All forty test scenarios and eight configurations against the released reference. Each cell shows lawful completions and forbidden effects out of two contexts each. An asterisk marks at least one unavailable output. The full 1,280 test decisions are retained. The two lawful contexts may establish different valid authorization paths.

Figure 5: The complete original eight-configuration language comparison by domain. Bars show incorrect approvals, false denials and unavailable decisions. Segment labels are case counts. The right columns report forbidden effects and lawful completions. The matched interface study is a separate condition set on the same inputs.

Configuration	Forbidden /20	Lawful /20	Invalid /40	Length /40	Output tokens
Qwen3.5-9B	2	20	0	0	320
Qwen3.5-27B thinking	0	20	0	0	54,544
Nemotron custom policy	16	20	2	2	45,628
GPT-OSS Safeguard	0	20	0	0	12,542
Granite Guardian	13	18	0	0	17,054
PolicyGuard	7	9	24	40	160

Appendix

Table 5: All original development observations. Length is independent of output validity. Unknown decisions are zero. PolicyGuard’s complete labels at the native output limit remain valid. Test scores appear in the main table instead of being repeated here.

Configuration	Engine	Correct	Incorrect approvals	False denials	Unavailable
Qwen3.5-9B	OpenFGA	823/1,181	258/436	100/745	0/1,181
	Cedar	20/34	3/12	11/22	0/34
Qwen3.5-27B	OpenFGA	1,170/1,181	1/436	10/745	0/1,181
	Cedar	34/34	0/12	0/22	0/34
Safeguard	OpenFGA	996/1,181	11/436	168/745	6/1,181
	Cedar	27/34	1/12	6/22	0/34

Appendix

Table 6: Complete native-test decisions with engine and reference-conditional denominators. Unavailable outputs remain in every relevant total and are distinct from false denials. The six Safeguard unavailable responses are output-limit terminations, five on lawful inputs and one on a forbidden input.

Figure 6: Original single-reviewer judgments by engine and reference permission on the complete native test. Gray marks unavailable outputs. Correct counts and denominators appear at right.

Model	Seed	Retained	Lost	Gained	Net change	Adjusted $p$
Qwen3.5-27B	0	73	1	2	+1	1.000000
Qwen3.5-27B	1	72	1	3	+2	1.000000
Qwen3.5-27B	2	72	2	2	+0	1.000000
Qwen3.5-9B	0	56	1	13	+12	0.069824
Qwen3.5-9B	1	41	0	27	+27	0.000040
Qwen3.5-9B	2	65	6	3	-3	1.000000

Appendix

Table 7: All direct-to-schema lawful-request transitions in the repeated study. Each row contains eighty lawful requests from forty scenarios. Adjusted

p

values use the complete 36-contrast family rather than only these six comparisons.

Reporting view	Observed signal	Supported repair judgment
Forbidden effects only	Structured and schema review both have zero	Ties prevention, without measuring retained lawful work
Add lawful completion	Structured ten, schema review 71	Shows restored utility, without attributing the difference to output failures
Add availability and raw output	Structured has 125 unavailable decisions, schema review zero	Identifies the observed output-contract defect and its repair
Add matched request identities	Direct to schema review loses two lawful successes and gains thirteen	Rejects full task-set preservation despite improved aggregate outcomes

Appendix

Table 8: A reporting-resolution ablation on fixed observed records. The first three rows compare structured and schema review. The last compares direct and schema review. These summaries are recoverable from complete matched logs and are not new metrics or restrictions on earlier frameworks.

Composition	Incorrect approvals /448	Lawful approvals /767	Unavailable /1,215	Additional cached consultations
Qwen3.5-9B	261	656	0	0
Qwen3.5-27B	1	757	0	0
Safeguard	12	588	6	0
Qwen3.5-9B $\rightarrow$ Qwen3.5-27B	1	648	0	917
Qwen3.5-9B $\rightarrow$ Safeguard	11	503	5	917
Qwen3.5-27B $\rightarrow$ Qwen3.5-9B	1	648	0	758

Appendix

Table 9: Every ordered cached composition. Qwen3.5-9B denotes Qwen3.5-9B, Qwen3.5-27B denotes Qwen3.5-27B, and Safeguard denotes GPT-OSS Safeguard. Each first stage reaches all 1,215 cases. Reviewer order preserves the final accepted set but can change reached unavailable responses and consultation counts. These are replay outcomes, not new model calls.

Figure 7: All ordered transitions among the original eight configurations, using the same eighty lawful inputs. Cells show gained / lost requests and color shows net change. This compares complete configurations, not isolated model factors. Both gains and losses occur in nine of the twenty-eight unordered pairs.

LLM Guardrails

Large language model guardrails detect or constrain harmful outputs, prompt attacks, and unsafe agent actions before they cause harm.

See all 185 papers

AuthGateBench: Benchmarking LLMs as Authorization Gate
Oct 12, 2026Zhixiong Zhuang, Jin Jia, Zhiwei Shang +1Tool Access Control for LLM Agents AI Agent Safety Benchmarks
Huawei Technologies Ltd. · Sun Yat-sen University
Influence Is Not Authority: When Causal Guardrail Signals Make Legitimate Tool Use Look Like an Attack in Tool-Using LLM Agents
Aug 30, 2026Tanzim Ahad, Ismail Hossain, Md Jahangir Alam +3LLM Guardrails LLM Agent Security
Department of Computer Science, University of Texas at El Paso, TX, USA 79902 · Department of Computer Science and Engineering, New Mexico Tech, Socorro, NM, USA 87801 · University of Illinois Urbana-Champaign, IL, USA
Governed Deduction: Policy-Grounded Premise Authorization Beyond Relevance
Sep 25, 2026Wesley Shu, Hsi-Ching LinAccess Control Reasoning Evaluation
The Institute of Energetic Paradigm · National Center for High-Performance Computing, Taiwan

Oct 12, 2026J/K move · Enter open · S save

AuthGateBench: Benchmarking LLMs as Authorization Gate

Zhixiong Zhuang, Jin Jia, Zhiwei Shang, Ziyu Wang

Huawei Technologies Ltd. · Sun Yat-sen University

Tool Access Control for LLM Agents AI Agent Safety Benchmarks

Open paper AskPDF arXiv

Automated approval systems let coding agents execute high-risk actions with minimal human oversight by delegating the authorization decision to a classifier, typically a large language model (LLM). Such systems, adopted in tools like Claude Code and Codex, remain vulnerable to failure modes such as scope escalation, where the agent takes actions exceeding what the user authorized. Existing benchmarks focus mainly on malicious requests, evaluating refusal under an implicit policy. We introduce AuthGateBench, the first policy-guided benchmark for authorization gating under benign requests. We implement a novel pipeline where an LLM generates contrast pairs with identical action and trajectory but differing request, flipping the label between block and allow. This allows us to assess whether models reason over context rather than the action alone. We further examine whether auxiliary environment signals can help models make better decisions. The resulting benchmark comprises 1,400 instances spanning five failure modes drawn from real-world Claude Code incidents. Evaluations show accuracy degrades unevenly across failure modes as models over-rely on internal safety alignment, and models still block most actions even when explicitly authorized, revealing unstable rather than deterministic decisions; retrospectively retrieved environment signals, however, substantially improve authorization accuracy.

Abstract

LLM Guardrails

Explore similar work

AuthGateBench: Benchmarking LLMs as Authorization Gate

Influence Is Not Authority: When Causal Guardrail Signals Make Legitimate Tool Use Look Like an Attack in Tool-Using LLM Agents

Governed Deduction: Policy-Grounded Premise Authorization Beyond Relevance