Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents

Anmol Pandey; Aditya Jain; Liang Chen; Carsten Maple

cs.CROct 20, 2026

Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents

Authors: Anmol Pandey, Aditya Jain, Liang Chen, Carsten Maple

Organizations: University of Warwick, Coventry, United Kingdom · University of Hertfordshire, Hatfield, United Kingdom

Abstract

Autonomous LLM agents act through tools under per-action authorization: a local guard screens each tool call in isolation. We show that local authorization does not compose into global authorization. A compositional authorization failure (CAF) is a locally authorized execution, or a pair of locally authorized executions, that violates a global policy spanning intent, purpose, provenance, consent, and delegation. We characterize CAFs along two axes, expressiveness (single-trace safety versus relational k-safety) and observability (a ladder of monitor profiles). Our central result is an impossibility: relational purpose violations form a 2-safety hyperproperty with no per-trace locus of blame, so a per-action monitor that never raises a false alarm detects none of them, independent of the underlying model or decision procedure; they become visible only under cross-execution monitoring, which none of the six guardrails we survey implements. We make this constructive with AL-SYNTH, a SAT/SMT synthesizer (using no language model) that emits minimal CAF witnesses, each checked against an exhaustive oracle. The empirical signature is sharp: across nine LLM judges the per-action view approves the synthesized witness almost without exception, blocking it at a rate comparable to a benign control, yet the same models flag it when shown the two executions together. Per-action authorization is therefore structurally insufficient for relational policy conjuncts not reducible to single-trace safety: to bound them, a monitor must compare executions or accept false alarms.

Figures & tables

Panel of Figure 1 — Fig. 1: A compositional authorization failure, single-trace case. Every action passes its local check (top), yet the composed trace violates the global policy $\Phi$ (bottom), with no single offending step. The relational purpose failure is witnessed instead by a pair of individually compliant executions (Figure 3 ).

Panel of Figure 2 — Fig. 2: The two-axis map, with class labels as in Table III . Increasing observability (left to right) covers the single-trace classes one by one (teal). The relational purpose class $C_{2}\,r$ (coral) is $2$ -safety, so no single-execution profile can express it; it is covered only by the relational profile $P_{7}$ , beyond the strongest profile any surveyed system reaches. The bottom row is the number of undetected classes per profile, the monitor-coverage curve of § VII .

Panel of Figure 3 — Fig. 3: Why purpose is relational. Two executions agree on the low inputs and on the purpose-authorized view of context (the same slots are free) and differ only in a hidden, unauthorized reason. Each offers a free slot, so neither trace alone is faulty, yet the disclosures differ ( $\alpha(\mathsf{obs}_{a})\neq\alpha(\mathsf{obs}_{b})$ ). That difference is explained only by the unauthorized reason, so the pair is the $2$ -safety witness for $C_{2}^{D}$ : it is visible only by comparing executions, which a relational ( $P_{7}$ ) monitor does and a per-action monitor cannot.

Panel of Figure 4 — Fig. 4: AL-Synth . One symbolic model with two semantics drives an SMT solver and an exhaustive oracle. A differential check compares them (soundness, bounded completeness, minimality), and the validated pipeline emits minimal witnesses and computes the monitor-coverage curve.

CAF (sub)class	$P_{0}$	$P_{1}$	$P_{2}$	$P_{3}$	$P_{4}$	$P_{5}$	$P_{5}{+}$	$P_{6}$	$P_{7}$
$C_{1}$ intent	$\circ$	$\bullet$	$\bullet$	$\bullet$	$\bullet$	$\bullet$	$\bullet$	$\bullet$	$\bullet$
$C_{2}$ purpose (labeled)	$\circ$	$\circ$	$\bullet$	$\bullet$	$\bullet$	$\bullet$	$\bullet$	$\bullet$	$\bullet$
$C_{2}$ purpose (relational)	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$	$\bullet$
$C_{3}$ provenance (path)	$\circ$	$\circ$	$\circ$	$\bullet$	$\bullet$	$\bullet$	$\bullet$	$\bullet$	$\bullet$
$C_{3}$ flow (explicit labeled)	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$	◐	◐
$C_{4}$ consent (per-action)	$\circ$	$\circ$	$\circ$	$\circ$	$\bullet$	$\bullet$	$\bullet$	$\bullet$	$\bullet$

TABLE I: Monitor-coverage matrix, solver-validated and confirmed against the brute-force oracle (all

72

cells agree).

\bullet

: the profile detects the class exactly, flagging every witness and no compliant trace. ◐ : detects it only conservatively, a sound over-approximation that admits most compliant traces at the cost of some false alarms.

\circ

: no monitor at that profile detects it without missing witnesses or blocking compliant behavior. The one ◐ row is explicit labeled flow, over-approximated by taint tracking at

P_{6}

and above. Both

\bullet

and ◐ count as covered in the bottom-row curve. Only relational purpose (

C_{2}

, shaded

\bullet

) admits no per-trace coverage at all, closing at

P_{7}

(Theorem 3 ).

Panel of Figure 6 — Fig. 5: Synthesis cost on the cumulative-consent model (11 actions, Z3 4.16). Minimal-witness synthesis (dashed) stays flat to depth twelve, while all-SAT enumeration (solid, used only for the oracle check) grows exponentially with the witness count (annotated). One model; times are illustrative, not a benchmark.

Mechanism	What it observes	Profile	Cross-exec.
Per-tool approval	current action, shown to a human	$P_{0}$	no
Task Shield [ 16 ]	action versus task goal	$P_{1}$	no
RTBAS [ 17 ]	IFC taint and dependencies	$P_{3}$	no
CaMeL [ 18 ]	data and control flow, capabilities	$P_{5}$	no
Fides [ 8 ]	IFC labels, explicit secrecy	$P_{6}$	no
SAFEFLOW [ 19 ]	IFC labels and provenance	$P_{6}$	no

TABLE II: Surveyed agent-authorization mechanisms and the profile each receives in Table III . “Cross-exec.” asks whether the mechanism compares distinct executions of the same purpose, the

P_{7}

capability.

mechanism (profile)	$C_{1}$	$C_{2}\,\ell$	$C_{2}\,r$	$C_{3}\,p$	$C_{3}\,\mathrm{f}$	$C_{4}\,\mathrm{a}$	$C_{4}\,\mathrm{c}$	$C_{5}$
Per-tool approval ( $P_{0}$ )	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$
Task Shield [ 16 ] ( $P_{1}$ )	$\bullet$	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$	$\circ$
RTBAS [ 17 ] ( $P_{3}$ )	$\bullet$	$\bullet$	$\circ$	$\bullet$	$\circ$	$\circ$	$\circ$	$\circ$
CaMeL [ 18 ] ( $P_{5}$ )	$\bullet$	$\bullet$	$\circ$	$\bullet$	$\circ$	$\bullet$	$\circ$	$\bullet$
Fides [ 8 ] ( $P_{6}$ )	$\bullet$	$\bullet$	$\circ$	$\bullet$	◐	$\bullet$	$\bullet$	$\bullet$
SAFEFLOW [ 19 ] ( $P_{6}$ )	$\bullet$	$\bullet$	$\circ$	$\bullet$	◐	$\bullet$	$\bullet$	$\bullet$

TABLE III: Defense matrix, confirmed against the brute-force oracle; symbols as in Table I . Each mechanism is placed at the strongest profile its published design implements, so its row is a capability bound from the design, not an execution of its code. The relational purpose column (shaded) is missed by every surveyed mechanism: Fides and SAFEFLOW (

P_{6}

) cover six classes exactly and explicit labeled flow conservatively, and only the relational auditor (

P_{7}

) covers relational purpose.

Task	Class	$n$	CAF	$95\%$ UB
Injected-doc forward	$C_{1}$	$10$	$0$	$\leq 26\%$
Narrow-scope share	$C_{4}$	$10$	$0$	$\leq 26\%$
Scheduling audit	$C_{2}\,r$	$80$	$0^{\dagger}$	$\leq 3.7\%$

TABLE IV: Offline audit of Claude Sonnet 4.6 (fixed temperature). CAF is the number of compositional authorization failures observed; UB is the exact one-sided

95\%

Clopper–Pearson upper bound on the per-episode rate. Prompts, seeds, and settings are in the artifact.

judge	wit	ben	C1	aud
Claude Opus 4.8	$0/30$	$0/30$	$30/30$	$30/30$
GPT-5.5	$0/30$	$0/30$	$30/30$	$30/30$
Gemini 3.1 Pro	$0/30$	$0/30$	$30/30$	$30/30$
Grok 4.3	$0/30$	$0/30$	$30/30$	$30/30$
DeepSeek V4 Pro	$0/30$	$2/30$	$30/30$	$30/30$
Qwen3.7-max	$0/30$	$0/30$	$30/30$	$30/30$

TABLE V: Per-action judges over the synthesized relational witness. Cells count the scenario-repetitions, out of

30

(ten templates, three repetitions), in which the judge blocks at least one action: wit the witness, ben a benign no-leak control, C1 an overt single-trace control, and aud the relational auditor, the same model shown both executions. Hosted models ran through OpenRouter and the local model through vLLM.

	Qwen3-30B		Gemma-4
guard	CAF	CAF-free	CAF	CAF-free
no guard ( $P_{0}$ )	$22/60$	$63.3\%$	$0/60$	$100\%$
intent-closure	$20/60$	$66.7\%$	$0/60$	$100\%$
composition ( $P_{5}{+}$ )	$0/60$	$100\%$	$0/60$	$100\%$

TABLE VI: Live tool-calling agents on the cumulative-consent task (

60

independent rollouts per cell at fixed temperature, zero execution errors). CAF : consent-composition failures committed. CAF-free : fraction of rollouts with no CAF, a natural rate under no guard and a prevention rate under a guard. The composition-aware

P_{5}{+}

guard removes every CAF while blocking no benign or clean-intent rollouts.

Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

Display name	API slug
Claude Opus 4.8	anthropic/claude-opus-4.8
GPT-5.5	openai/gpt-5.5
Gemini 3.1 Pro	google/gemini-3.1-pro-preview
Grok 4.3	x-ai/grok-4.3
DeepSeek V4 Pro	deepseek/deepseek-v4-pro
Qwen3.7-max	qwen/qwen3.7-max

Appendix

TABLE VII: Judge models and exact API slugs for the campaign of § VIII ; settings in the text, accessed June 2026.

LLM Agent Safety

Large language model agent safety studies how to keep tool-using, persistent, and multi-agent systems aligned with user intent and authorized limits.

See all 327 papers

Who Speaks, Who Authorizes, Who Acts? Understanding Trust Boundaries in Multi-Agent LLMs
Oct 16, 2026Junru Zhu, Xin Chen, Hang Lyu +6Multi-Agent LLM Systems AI Agent Security
Act on Your Behalf, Beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment
Oct 20, 2026Zhiping Zhang, Franklin Mingzhe Li, Zihao Huang +1LLM Agent Evaluation AI Agent Safety Benchmarks
Northeastern University · Carnegie Mellon University · UNC-Chapel Hill
FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs
Jul 29, 2026Yifan Zhang, Xinkui Zhao, Sai Liu +3LLM Agent Security Tool Access Control for LLM Agents
Zhejiang University

Oct 16, 2026J/K move · Enter open · S save

Who Speaks, Who Authorizes, Who Acts? Understanding Trust Boundaries in Multi-Agent LLMs

Junru Zhu, Xin Chen, Hang Lyu, Jiayue Meng+5

Multi-Agent LLM Systems AI Agent Security LLM Agent Safety Trustworthy AI Tool Access Control for LLM Agents

Open paper AskPDF arXiv

Multi-agent LLM systems exchange messages before acting through tools, but message delivery, signing authority, and tool-side enforcement are separate trust boundaries. We represent them as communication, authorization, and execution structures, and use the authority cut to characterize the smallest independently compromised signer coalition that can construct a policy-valid false-claim proof under stated assumptions. Controlled paired hidden-state studies reveal four distinctions. First, no fixed-message routing contrast across four models meets the prespecified large-effect criterion; when relays rewrite messages, executed false-state action rates vary by model and route configuration. Second, presented source-identity cues do not uniformly increase protected-action selection across three models. Third, on invalid-proof cases, Nemotron and Llama request protected actions in 52.1% and 54.2% of trials, respectively, yet a deterministic tool gate commits none: request-level and commitment-level safety readouts diverge. Finally, a separate single-model authorization check shows that a false claim with a policy-valid compromised-signer proof can pass the gate, since proof validity is not factual truth. These findings motivate evaluating delivered information, qualified authorization, model proposals, and committed actions separately.

Abstract

LLM Agent Safety

Explore similar work

Who Speaks, Who Authorizes, Who Acts? Understanding Trust Boundaries in Multi-Agent LLMs

Act on Your Behalf, Beyond Your Authorization: Benchmarking LLM Agent Authorization Alignment

FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs