Tool Access Control for LLM Agents

LLM: Large Language Model

Ask about this topic

Overview

This field studies how to ensure an LLM agent uses only the tools and permissions justified by a user's task, across settings such as APIs, browsers, coding environments, and MCP-based systems. Common approaches include task-scoped least-privilege policies, capability-based delegation, provenance and information-flow tracking, and runtime gateways that check calls before execution or commit; human approval is often reserved for consequential actions. Evidence shows that prompts and static tool allowlists can leave gaps, especially when calls change meaning across steps, permissions persist, or authorization is not bound to the exact action and current state. A central challenge is balancing strong, verifiable restrictions with useful autonomy, while evaluating both unauthorized effects and unnecessary denials in realistic, long-running workflows.

Latest papers

CardsList

222 papers42 papers in the last four weeks, up 8% on the four weeks before. 0.2% of all new papers.

  1. REALM: Identifying Minimal Task Assets for LLM Agents

    Oct 29, 2026Zihou Ren, Byungchul Tak, Long WangAI Agent SecurityTool Access Control for LLM Agents

    INSC, Tsinghua University · Kyungpook National University

  2. Concordat: Typed Sessions for LLM Agents

    Oct 27, 2026Milad SikaroudiRuntime Enforcement for AI AgentsTool Access Control for LLM Agents

    Independent Researcher

  3. I-HITL: Inalienable Human-in-the-Loop

    Oct 26, 2026Samuel Breckenridge, Dani Vilardell, Wenhao Wang +2Human-in-the-Loop AIAI Agent Safety

    Cornell Tech, IC3 · Yale University, IC3

  4. CoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystems

    Oct 26, 2026Yujia Zheng, Tianhao Li, Shangzhi Xu +6LLM Agent SecurityLLM Agent Safety

    University of Science and Technology Beijing · ZODA · Fangcun Leap +5

  5. LLM WikiLeaks: Uncovering URL-Based Capability Extension and Security Circumvention in Agentic Message Boards

    Oct 25, 2026Orel Navi, Elad Feldman, Ben NassiLLM Agent SecurityWeb Agents

    Tel Aviv University, Tel Aviv, Israel

  6. Task Success Is Not Enough: Side-effect-Aware Evaluation of Tool-Using Language Model Agents

    Oct 25, 2026Jiaju Huang, Shaobin Chen, Xinglong Liang +5LLM Agent EvaluationLLM Agent Safety

    Macao Polytechnic University · Southwest Medical University · Netherlands Cancer Institute +1

  7. A Deterministic Security Runtime for LLM Agents on MPI and Batch-Scheduled HPC Systems: Consensus-Governed, Hardware-Rooted Supervision of Every Rank

    Oct 23, 2026Alfredo MetereLLM Agent SecurityRuntime Enforcement for AI Agents

    Enclawed, Inc., California, USA

  8. Agentic AI Defense: Decode-Time Provenance Binding for MCP

    Oct 22, 2026Eric Yocam, Varghese Vaidyan, Paris Kalathas +3AI Agent SecurityPrompt Injection Attacks on AI Agents

    Beacom College of Computer and Cyber Sciences, Dakota State University, Madison, SD, USA. · Information Networking Institute, Carnegie Mellon University, Pittsburgh, PA, USA.

  9. Certified Execution Harness for Agentic AI: Safe and Least-Intrusive Petri-Net Supervisory Control Between Reasoning and Action

    Oct 22, 2026Chao Gu, Quanyan ZhuTool Access Control for LLM AgentsRuntime Enforcement for AI Agents

    C. Gu is with the School of Electronics, Electrical Engineering and Computer Science, Queen’s University Belfast, Belfast, UK · Q. Zhu is with the Department of Electrical and Computer Engineering, New York University, Brooklyn, NY 11201, USA

  10. AgentPolicyForge: From Executable Environments to Policy Benchmarks and Adaptive Guards

    Oct 20, 2026Chao Shang, Wanyu Du, Yi Zhang +1Tool Access Control for LLM AgentsLLM Guardrails

    AWS AI Labs

  11. ClawMMU: Protection-Coherent Virtual Memory for Stateful LLM Agents

    Oct 20, 2026Jinhao Hu, Bardia Mohammadi, Mofasshara Binte Rafique +4AI Agent SecurityMemory Management for LLM Agents

    MPI-SWS · Unaffiliated · EPFL +2

  12. Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents

    Oct 20, 2026Anmol Pandey, Aditya Jain, Liang Chen +1LLM Agent SafetyTool Access Control for LLM Agents

    University of Warwick, Coventry, United Kingdom · University of Hertfordshire, Hatfield, United Kingdom

  13. Runtime Control for AI Agents: Closing the Evaluation--Execution Gap in Operational Workflows

    Oct 20, 2026Jayesh Bhadane, Ramachandra Yerramsetti, Rajesh Gupta +1Runtime Enforcement for AI AgentsRuntime Assurance

  14. Agentic Orchestration of EDC Data Space Retrieval and Natural Language Driven Data Processing

    Oct 19, 2026Marla Grunewald, Fin Gentzen, Iulisloi Zacarias +1Multi-Agent OrchestrationTool Access Control for LLM Agents

    Institute of Computer and Network Engineering, Technische Universität Braunschweig, Germany

  15. Who Speaks, Who Authorizes, Who Acts? Understanding Trust Boundaries in Multi-Agent LLMs

    Oct 16, 2026Junru Zhu, Xin Chen, Hang Lyu +6Multi-Agent LLM SystemsAI Agent Security

  16. From Approval to Abuse: Privilege Escalation Attacks on Harness-Protected Coding Agents

    Oct 16, 2026Xianglin Yang, Yechao Zhang, Jiahao Liu +4AI Agent SecurityLLM Agent Harnesses

    National University of Singapore · Nanyang Technological University · Ant Group

  17. FAOPs: Normal Forms and an Algebra for AI Agent Workflows

    Oct 15, 2026Ali Mohammadi ShanghooshabadLLM Agent Workflow OptimizationRuntime Enforcement for AI Agents

    JPMorgan Chase & Co.

  18. Approve What, Exactly? Effect Binding and Trusted Rendering for Agent Step-Up Authorization

    Oct 15, 2026Sai Varun Kodathala, Prashanth Pollishetty, Jaylen CargillAI Agent SecurityTool Access Control for LLM Agents

    SportsVision AI Minnetonka, MN

  19. L3M: A Verifiable Harness and Runtime for Self-Extending and Self-Improving Agents

    Oct 14, 2026Carson Eisenach, Robert Joseph George, Vincent Quenneville-Belair +2LLM Agent HarnessesRuntime Enforcement for AI Agents

    Amazon

  20. Beyond Maliciousness: Static and Runtime Attack-Surface Profiling of Agent Skills

    Oct 13, 2026Ratnesh Pandey, Japneet Singh, Harsh Akshit +2AI Agent SecurityAgent Skill Security Auditing

    Metano Labs · Purdue University · VulNow

  21. Kairos: Transactional Security Enforcement at the System Boundary for LLM Agents

    Oct 13, 2026Kristoffer Hempel, Nils Loose, Lorenzo Cavallaro +1LLM Agent SecurityRuntime Enforcement for AI Agents

    Universität zu Lübeck · University College London · Mohamed bin Zayed University of Artificial Intelligence

  22. The Agent Knew: Internal States Forecast Unauthorized Actions and Stop Them, and the Lies That Follow

    Oct 12, 2026Arya Fayyazi, Mehdi Kamal, Massoud PedramDeception in Language ModelsRuntime Enforcement for AI Agents

    University of Southern California, Los Angeles, CA, USA.

  23. AuthGateBench: Benchmarking LLMs as Authorization Gate

    Oct 12, 2026Zhixiong Zhuang, Jin Jia, Zhiwei Shang +1Tool Access Control for LLM AgentsAI Agent Safety Benchmarks

    Huawei Technologies Ltd. · Sun Yat-sen University

  24. Revocation Is Not Complete at Receipt: An Executable Outcome Contract for Distributed Agent-Tool Gateways

    Oct 11, 2026Lifei Liu, Haoran Yu, Danping ZhangRuntime Enforcement for AI AgentsAccess Control

    Independent Researcher Seattle, WA, USA · Nanchang Hangkong University Nanchang, China

  25. RetryBench: Separating Retry Permission from Recovery Outcomes in GPT Tool Use

    Oct 11, 2026You Liu, Yue Liu, Quanchao LuTool UseTool Access Control for LLM Agents

  26. KedgeFlow: A Programmable Control Plane for Enterprise AI Agents

    Oct 10, 2026Jun He, Deying YuRuntime Enforcement for AI AgentsTool Access Control for LLM Agents

  27. From Reactive Containment to Proactive Assurance: Lessons from OpenAI, Anthropic, and Google Agent Security Incidents

    Oct 8, 2026Abbas RaftariAI Agent SecurityRuntime Enforcement for AI Agents

    Walsh College, Troy, Michigan, USA

  28. NOMOS: Compiling Written Policies into Statically Verified Tool-Call Gates for LLM Agents

    Oct 8, 2026Min-Young Yu, Tony Kim, Jang Won ChoiTool Access Control for LLM AgentsLLM Agent Safety

    Corners Co., Ltd.

  29. Constrained-Action AI Remediation for SIEM/XDR via a NeMo-Guardrails Proxy

    Oct 7, 2026Georgios Koutidis, Nikolaos Kekatos, Tom Nianios +1LLMs for CybersecurityTool Access Control for LLM Agents

    Clone Systems, Larnaca, Cyprus · University of Thessaly, Department of Intelligent Energy Systems, Larissa, Greece

  30. Multi-Aspect Runtime Verification for Simulation-Based V&V of LLM-Enabled Autonomous Agents

    Oct 6, 2026Nikolaos Kekatos, Dimitrios Nikou, Anastasios Temperekidis +4LLM Agent VerificationRuntime Enforcement for AI Agents

    Clone Systems, Cyprus · International Hellenic University, Greece · University of Thessaly, Greece +2