Tool Access Control for LLM Agents

LLM: Large Language Model

This field studies how to ensure an LLM agent uses only the tools and permissions justified by a user's task, across settings such as APIs, browsers, coding environments, and MCP-based systems. Common approaches include task-scoped least-privilege policies, capability-based delegation, provenance and information-flow tracking, and runtime gateways that check calls before execution or commit; human approval is often reserved for consequential actions. Evidence shows that prompts and static tool allowlists can leave gaps, especially when calls change meaning across steps, permissions persist, or authorization is not bound to the exact action and current state. A central challenge is balancing strong, verifiable restrictions with useful autonomy, while evaluating both unauthorized effects and unnecessary denials in realistic, long-running workflows.

Latest papers

222 papers42 papers in the last four weeks, up 8% on the four weeks before. 0.2% of all new papers.

Permission Denied: Policy-Graded Evaluation of Coding Agents in Hardened Environments
Aug 2, 2026Dotan Davidovich, Yair Amar, Hai Rozencwajg +1Software Engineering Agents LLM Agent Evaluation
Accomplish AI
CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents
Jul 31, 2026Blaise Delattre, Cong Wang, Yang CaoLLM Agent Security Tool-Using Agents
Department of Computer Science, School of Computing, Institute of Science Tokyo, Tokyo, Japan · City University of Hong Kong
Memory Provenance Laundering in LLM Agents: A Non-Amplification Firewall for Persistent Memory
Jul 31, 2026Jinghan Xu, Yiyong Xiao, Wanru Shao +2Agent Memory Poisoning Tool Access Control for LLM Agents
HALO: Heterogeneous Admission through Localized Obligations for Safe Agentic Execution
Jul 30, 2026Taewoo Park, Kyeonghyun Yoo, Kiseok Kim +2AI Agent Safety Runtime Enforcement for AI Agents
Korea University
FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs
Jul 29, 2026Yifan Zhang, Xinkui Zhao, Sai Liu +3LLM Agent Security Tool Access Control for LLM Agents
Zhejiang University
Distributing Security Controls Through Harness Engineering
Jul 28, 2026William Robert GoreAI Agent Security LLM Agent Security
Georgia Institute of Technology
Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales
Jul 28, 2026Genliang Zhu, Chu WangLLM Agent Security LLM Agent Verification
Accentrust · Georgia Institute of Technology · University of Illinois Urbana-Champaign
Hybrid Analysis for Secure MCP Tool Use in LLM Agents
Jul 28, 2026Ping He, Yuexiang Xie, Yaliang Li +1MCP Security LLM Agent Security
Zhejiang University · Alibaba Group
Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents
Jul 27, 2026Arseny Kravchenko, Vadim Liventsev, Innokentii Konstantinov +2LLM Agent Security Prompt Injection Attacks on AI Agents
Archestra AI
MemTX: Transactional Belief Commit for Stateful Agent Memory
Jul 27, 2026Xiaoyang Li, Yiqi Wang, Haohui Lu +5Belief Revision LLM Agent Safety
University of Southern Queensland · 2Griffith University · 3The University of Sydney +2
Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents
Jul 26, 2026Zhaoxi Zhang, Xiaomei ZhangTool-Use Authorization Tool Access Control for LLM Agents
University of Technology Sydney · Griffith University
Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecture
Jul 24, 2026Halil Burak NoyanLLM Agent Security AI Agent Security Benchmarks
Independent Researcher, London, United Kingdom.
ToolGuardian: Declarative Security for AI Agent-Tool Interactions
Jul 23, 2026Arun Ravindran, Saurabh DeochakeAI Agent Security LLM Agent Security
Department of Electrical and Computer Engineering University of North Carolina at Charlotte Charlotte, NC · SentinelOne Mountain View, CA
Cryptographically verifiable authorization for autonomous AI agents: a falsifiable hypothesis and proof of concept
Jul 23, 2026M. Llambí-Morillas, D. Fernández-FernándezAI Agent Security AI Agent Governance
Universidad Tecnológica Atlántico-Mediterráneo (UTAMED) · Universidad de Santiago de Compostela (USC)
Data Leakage Prevention in Agentic Applications via Preemptive Hardening
Jul 21, 2026Akansha Shukla, Emily Bellov, Parth Atulbhai Gandhi +2AI Agent Security LLM Agent Security
Faculty of Computer and Information Science Ben-Gurion University of the Negev Beer-Sheva, Israel
RT-SHCUA: Real-Time Self-Hosted Computer-Use Agent for UAV Control
Jul 20, 2026Di Lu, Bo Zhang, Xiyuan Li +5Aerial Robotics Safety-Critical Control
School of Cyber Engineering, Shaanxi Key Lab of Network and System Security, Xidian University, Xi’an, Shaanxi 710071, China. · College of Cyber Security, Jinan University, Guangzhou 510632, China.
Scalable LLM Agent Tool Access in the Cloud
Jul 17, 2026Mingxin Li, Enge Song, Yueshang Zuo +27LLM Tool Use Model Context Protocol
Nanjing University · Alibaba Cloud · Fudan University +3
How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement
Jul 15, 2026Alexandra E. Michael, Franziska RoesnerAI Agent Security Tool Access Control for LLM Agents
University of Washington
Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions
Jul 14, 2026Huihao Jing, Wenbin Hu, Shaojin Chen +10LLM Agent Security LLM Agent Safety
HKUST · NYU · SWUPL
NetInjectBench: Benchmarking Indirect Prompt Injection in Tool-Using Large Language Model Agents for Network Operations
Jul 11, 2026Ruksat Khan Shayoni, Muhammad Faraz Shoaib, S M Asif Hossain +1AI Agent Security Benchmarks Indirect Prompt Injection
School of Computing, Wichita State University, Kansas, USA · Department of Computer Science, American International University-Bangladesh, Dhaka, Bangladesh
Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agents
Jul 11, 2026Igor Santos-GrueiroSoftware Security LLM Agent Security
International University of La Rioja
Reason Less, Verify More: Deterministic Gates Recover a Silent Policy-Violation Failure Mode in Tool-Using LLM Agents
Jul 8, 2026Vikas Reddy, Sumanth Reddy Challaram, Abhishek BasuAgent Failure Analysis AI Agent Reliability
Independent Researcher · Indian Institute of Technology Kharagpur Kharagpur, India · Massachusetts Institute of Technology Cambridge, USA
The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilities
Jul 7, 2026Mohammadreza RashidiAI Coding Agents Software Security
Department of Computer Science AI and Media Analysis Lab Berlin, Germany
aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents
Jul 6, 2026Sai Varun KodathalaAI Agent Security LLM Agent Security
Research & Development SportsVision AI Minnetonka, MN
Untrusted Content Masking for Web Agents with Security Guarantees
Jul 6, 2026Kristina Nikolić, Egor Zverev, Javier Rando +3Prompt Injection Defense Tool Access Control for LLM Agents
ISTA · Anthropic
AGL-1: The Enterprise AI Governance Layer as a Control Plane for Trusted Enterprise Intelligence
Jul 3, 2026Roopam W. SureAI Assurance AI Agent Monitoring
Independent Researcher
CAGE-1: Control, Assurance, and Governance Evaluation for Enterprise Agentic AI
Jul 3, 2026Roopam W. SureAI Agent Evaluation AI Agent Safety
Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies
Jul 3, 2026Chris Schneider, Kriti Faujdar, Philipp Schoenegger +1LLM Agent Security Information Flow Control
1Microsoft AI · 2Microsoft
Determinants and Limits of LLM Security-Tool Orchestration: A Study with HexStrike-AI
Jul 3, 2026Romain Gerard, Assmaa Zeghaider, Yan GuoLLM Agent Orchestration LLM Agent Evaluation
University of Science and Technology of China, Hefei, China · Suzhou Institute for Advanced Research, University of Science and Technology of China
Steerability via constraints: a substrate for scalable oversight of coding agents
Jul 2, 2026Thomas WinningerScalable Oversight Coding Agents
Télécom SudParis, Évry-Courcouronnes, France · ENS Paris-Saclay, Gif-sur-Yvette, France

Aug 2, 2026J/K move · Enter open · S save

Permission Denied: Policy-Graded Evaluation of Coding Agents in Hardened Environments

Dotan Davidovich, Yair Amar, Hai Rozencwajg, Or Hiltch

Accomplish AI

Software Engineering Agents LLM Agent Evaluation AI Agent Security Benchmarks Tool Access Control for LLM Agents

Open paper AskPDF arXiv

Coding agents increasingly run inside organizations whose security controls (scoped credentials, restricted egress, read-only filesystems, non-root execution) constrain them like any other software. Existing benchmarks, however, evaluate agents almost exclusively in permissive sandboxes, so it is unknown how performance changes when policy is enforced. In this work, we evaluate 12 coding agents on Terminal-Bench 2.1 across nested security policy levels derived from common real-world enterprise restrictions. Hardening is never free but far from uniform: under the strictest policy, success losses reach 18.3 points and cost inflation 167.3%, and the two axes disagree; the model that best preserves success is also the one that loses the most efficiency, so model choice is policy-dependent. Beyond aggregate scores, we characterize how agents behave when policy blocks their actions and decompose the failures hardening induces: runs grind into timeouts or wrong solutions rather than stopping early, in a mix that differs by model. To ground comparisons, we verify task solvability under the strictest policy, separating model failures from tasks the policy forecloses. We release Boundary-Bench, an open-source hardening plugin enabling policy-constrained evaluation of coding agents on Terminal-Bench and compatible benchmarks.