Access Control

Ask about this topic

Overview

Access control determines which users, services, or AI agents may perform which operations on which data, supporting security, privacy, and accountability. Traditional approaches use role-based and attribute-based access control, policy languages such as Rego and Cedar, and formal analysis or testing to specify and verify permissions. Agentic systems add runtime checks for tool calls, delegation and revocation, information-flow tracking, and least-privilege scopes across workflows; benchmarks increasingly measure both policy compliance and task utility. A central challenge is enforcing authorization as context and authority change without leakage or privilege escalation, while avoiding excessive denials, latency, and loss of useful autonomy.

Latest papers

CardsList

71 papers10 papers in the last four weeks, up 11% on the four weeks before. 0.1% of all new papers.

  1. Auditing the Hand-Written Inputs of Learned Access Control

    Oct 22, 2026Arsalan Jalil Sarghaleh, Mehdi HazratiAccess ControlAlgorithmic Auditing

    Department of Electrical Engineering, Sharif University of Technology, Tehran, Iran · Department of Electrical and Computer Engineering, University of Victoria, Victoria, BC, Canada

  2. Agentic Orchestration of EDC Data Space Retrieval and Natural Language Driven Data Processing

    Oct 19, 2026Marla Grunewald, Fin Gentzen, Iulisloi Zacarias +1Multi-Agent OrchestrationTool Access Control for LLM Agents

    Institute of Computer and Network Engineering, Technische Universität Braunschweig, Germany

  3. Memory, Know Your PLACE: Governing Lifecycle State and Query-Time Eligibility in Persistent-Memory Agents

    Oct 18, 2026Chen-Fang Hu, Hong-Han Shuai, Woan-Shiuan ChienAgent Memory GovernanceMemory Management for LLM Agents

    Arˆete Honors Program, National Yang Ming Chiao Tung University, Taiwan · Institute of Electrical and Computer Engineering, National Yang Ming Chiao Tung University, Taiwan

  4. A Multi-Tiered AI Accessibility Model (MAIAM): Proportionate Access and Capability Limits for Comprehensive Frontier AI Safety

    Oct 14, 2026Chai K. Toh, Vasu Raj JainAI GovernanceAccess Control

    SAFE AI Foundation USA

  5. Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool Gateways

    Oct 11, 2026Lifei Liu, Haoran Yu, Danping ZhangRuntime Enforcement for AI AgentsAccess Control

    Independent Researcher Seattle, WA, USA · Nanchang Hangkong University Nanchang, China

  6. Evaluating Behavioral Context for Interpretable IAM Policy Risk Scoring in Cloud Environments

    Oct 5, 2026Yassin ElsharkawyCybersecurityAccess Control

    Dept. of Computers and Artificial Intelligence Capital University Cairo, Egypt

  7. Lineage-Aware Memory Governance: A Derivation-Gated Framework for Privacy-Preserving Column-Level Access Control in Enterprise AI Agents

    Oct 5, 2026Venkata M Sangaraju, Sudhir VissaData LeakageData Provenance

    Independent Researcher · SAGE7 AI, Georgetown, Texas, USA

  8. What May an Agent Change About Itself? A Containment Floor for Self-Configuring Agent Runtimes

    Oct 5, 2026Sajib Hossain, Moeen Uddin MahmudLLM Agent SecurityRuntime Enforcement for AI Agents

    North South University · HelicanHQ

  9. Trust-Gated Capability Control: Breaking the Trust-Vulnerability Paradox in Multi-Agent LLM Systems

    Oct 4, 2026Mehedi Hasan Nipu, Chinmoy Mitra, Tarannum Ahmed Nowshin +1Trust in AIMulti-Agent System Security

    Department of Electrical and Computer Engineering, North South University, Dhaka, Bangladesh · Department of Computer Science & Engineering Rajshahi University of Engineering & Technology Rajshahi, Bangladesh · Department of Computer Science and Engineering BRAC University,Dhaka, Bangladesh +1

  10. Deny Without Disabling: Authorization-Paired Evaluation and Control for Multi-Agent Systems

    Sep 30, 2026Yunbei Zhang, Saiyue Lyu, Janet Wang +4Multi-Agent CollaborationInformation Flow Control

    Tulane University · University of British Columbia · Independent Researcher +1

  11. RAISE: Reinforcing Access Control Policy Synthesis in LLMs via Symbolic Evaluation

    Sep 27, 2026Yingming Zhou, Adarsh Vatsa, William EiersRL for Language Model ReasoningLLM-Based Program Synthesis

    Stevens Institute of Technology

  12. Authority Before Utility: Non-Compensatory Control for Persistent LLM Memory

    Sep 26, 2026Wesley ShuPersistent Memory for Language ModelsAgent Memory Management

    The Institute of Energetic Paradigm

  13. Governed Deduction: Policy-Grounded Premise Authorization Beyond Relevance

    Sep 25, 2026Wesley Shu, Hsi-Ching LinAccess ControlReasoning Evaluation

    The Institute of Energetic Paradigm · National Center for High-Performance Computing, Taiwan

  14. Structured Decomposition for Reliable LLM-Generated Access Control Policies

    Sep 21, 2026Vatsal Gupta, Darshan SreenivasamurthyAccess ControlLLM Reliability

    Apple Inc., Cupertino, CA, USA

  15. A Policy Profile for Croissant: Refusal as a Property of the Dataset

    Sep 17, 2026Alexander ChernovPolicy EvaluationAccess Control

    Independent Researcher Toronto, Ontario, Canada

  16. BIO-MEMART: Biometric-Aware KV Cache Memory for Multi-User LLM Agents

    Sep 8, 2026Yanhong Qian, Xuanying He, Qingguo Meng +3Agent MemoryPrivacy-Preserving Language Models

    Anhui Provincial Key Laboratory of Secure Artificial Intelligence, School of Artificial Intelligence, Anhui University, Hefei 230093, China

  17. ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?

    Sep 8, 2026Moonwon Choi, Seokho Jeong, Sian Choi +1LLM Agent SecurityAccess Control

    Graduate School of Data Science, Seoul National University

  18. Versioned Transitive Dependency-Closure Binding and Operation-Time Effect Governance for Agent Skills: ClosureBound

    Sep 5, 2026Genliang Zhu, Chu WangRuntime Enforcement for AI AgentsAccess Control

    Accentrust · Georgia Institute of Technology · Accentrust, Vancouver, Canada +3

  19. Agent Memory Is a Surface for Endogenous Authorization Laundering

    Sep 1, 2026Tommaso Cerruti, Mika Okamoto, Ansel Kaplan ErolLLM Agent MemoryLLM Agent Security

    ETH Zurich · Georgia Institute of Technology

  20. VERA: Authority-Preserving Edge Revocation for Federated AI-Agent Workflows

    Aug 30, 2026Lifei Liu, Haoran Yu, Xiaochong JiangRuntime Enforcement for AI AgentsAccess Control

    Independent Researcher

  21. The Illusion of Independent Quorums: Epistemic Fault Domains and Correlated Cognitive Failures in Agentic Quorums

    Aug 24, 2026Jun He, Deying YuMulti-Agent SystemsAgent Failure Analysis

  22. A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem

    Aug 11, 2026Suraj Kumar, Amy Wang, Srinivasan ManoharanMCP SecurityTool-Use Authorization

    Enterprise AI Platform Engineering

  23. Beyond Single-Use Tokens: Durable Authorization State for Replay-Resistant LLM Agent Actions

    Aug 3, 2026Jinghan Xu, Longze Fan, Zeyuan Wang +2LLM Agent SecurityAccess Control

    1Nankai University, China · 2China University of Petroleum, China · 3Sun Yat-sen University, China +1

  24. Benchmarking Text-to-SQL under Role-Based Access Control

    Jul 24, 2026Yang Fei, Yangfan Jiang, Yin Yang +1Text-to-SQLSynthetic Benchmark Generation

    National University of Singapore · Hamad Bin Khalifa University

  25. A Formally Grounded ODRL Evaluator: Implementation and Comparison

    Jul 17, 2026Jaime Osvaldo Salas, Paolo Pareti, Adeel Aslam +2Policy EvaluationAccess Control

    University of Southampton, University Road, Southampton, SO17 1BJ, UK

  26. Policy-Conditioned Constrained Decoding for Column-Level Access Control in Text-to-SQL

    Jul 14, 2026Ryoto Miyamoto, Xin Fan, Hayato YamanaPrivacy Leakage in Language ModelsText-to-SQL

    Waseda University

  27. Closing the Loop: An Access-Control Architecture for Automated, Anomaly-Driven Network Revocation in IoT Deployments

    Jul 13, 2026Muhammet Emir Korkmaz, Kemal Bicakci, Yusuf UzunayAutonomous Cyber DefenseIoT Intrusion Detection

    Securify Information Technology and Security Training Consulting Inc., 06378, Ankara, TÜRK˙IYE · Informatics Institute, Istanbul Technical University, Ayazaga Campus, 34467, Maslak, Istanbul, TÜRK˙IYE

  28. Authority-Bound Governance of Heterogeneous AI Security Decisions in Telecom and IoT Networks

    Jul 10, 2026Saviz Changizi, Nasibeh Mohammadzadeh, Mohammad Shojafar +1CybersecurityAI Governance

    6G Innovation Centre, Institute for Communication Systems, University of Surrey, UK · Department of Network Engineering, Polytechnic University of Catalonia, Barcelona, Spain

  29. aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents

    Jul 6, 2026Sai Varun KodathalaAI Agent SecurityLLM Agent Security

    Research & Development SportsVision AI Minnetonka, MN

  30. Governed Individuation: Cryptographically Decoupling an Agent's Learning from Its Authority

    Jul 6, 2026Xue Qin, Simin Luan, Cong Yang +1AI Agent SecurityAI Agent Safety

    School of Software, Harbin Institute of Technology, Harbin, China · School of Computer Science and Technology, Harbin Institute of Technology, Harbin, China · School of Future Science and Engineering, Soochow University, Suzhou, China