Tool Access Control for LLM Agents

LLM: Large Language Model

This field studies how to ensure an LLM agent uses only the tools and permissions justified by a user's task, across settings such as APIs, browsers, coding environments, and MCP-based systems. Common approaches include task-scoped least-privilege policies, capability-based delegation, provenance and information-flow tracking, and runtime gateways that check calls before execution or commit; human approval is often reserved for consequential actions. Evidence shows that prompts and static tool allowlists can leave gaps, especially when calls change meaning across steps, permissions persist, or authorization is not bound to the exact action and current state. A central challenge is balancing strong, verifiable restrictions with useful autonomy, while evaluating both unauthorized effects and unnecessary denials in realistic, long-running workflows.

Latest papers

222 papers42 papers in the last four weeks, up 8% on the four weeks before. 0.2% of all new papers.

Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use
May 6, 2026Francisco Javier Arceo, Varsha Prasad NarsingLLM Agent Orchestration AI Agent Security
Red Hat AI · Boston, USA
AgentTrust: Runtime Safety Evaluation and Interception for AI Agent Tool Use
May 6, 2026Chenglin YangAI Agent Security AI Agent Security Benchmarks
Independent Researcher
Hybrid Inspection and Task-Based Access Control in Zero-Trust Agentic AI
May 4, 2026Majed El Helou, Benjamin Ryder, Chiara Troiani +3Cybersecurity LLM Agent Security
Cisco Systems, Switzerland
Enforcing Benign Trajectories: A Behavioral Firewall for Structured-Workflow AI Agents
Apr 29, 2026Hung DangLLM Agent Security AI Agent Monitoring
Van Lang University, Ho Chi Minh City, Vietnam
Governed MCP: Kernel-Level Tool Governance for AI Agents via Logit-Based Safety Primitives
Apr 18, 2026Daeyeon SonMCP Security AI Agent Security
Independent Researcher · Republic of Korea
SafeHarness: Lifecycle-Integrated Security Architecture for LLM-based Agent Deployment
Apr 15, 2026Xixun Lin, Yang Liu, Yancheng Chen +8LLM Agent Safety LLM Agent Harnesses
Institute of Information Engineering, Chinese Academy of Sciences · Academy of Mathematics and Systems Science, Chinese Academy of Sciences · Institute of Applied Physics and Computational Mathematics +1
ClawGuard: A Runtime Security Framework for Tool-Augmented LLM Agents Against Indirect Prompt Injection
Apr 13, 2026Wei Zhao, Zhe Li, Peixin Zhang +1AI Agent Security LLM Agent Security
Singapore Management University
Beyond Static Sandboxing: Learned Capability Governance for Autonomous AI Agents
Apr 12, 2026Bronislav Sidik, Lior RokachAI Agent Governance Tool Access Control for LLM Agents
Institute for Applied AI Research Faculty of Computer and Information Science Ben-Gurion University of the Negev, Beer Sheva, Israel
OpenKedge: Governing Agentic Mutation with Execution-Bound Safety and Evidence Chains
Apr 7, 2026Jun He, Deying YuAI Agent Governance Runtime Enforcement for AI Agents
A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanisms
Apr 7, 2026Nirajan Acharya, Gaurav Kumar GuptaMCP Security AI Agent Security
University of the Cumberlands · Youngstown State University
ClawLess: A Security Model of AI Agents
Apr 7, 2026Hongyi Lu, Nian Liu, Shuai Wang +1AI Agent Security Runtime Enforcement for AI Agents
Research Institute of Trustworthy Autonomous Systems, Southern University of Science and Technology, China · Department of Computer Science and Engineering, Southern University of Science and Technology · Department of Computer Science and Engineering, Hong Kong University of Science and Technology +3
Causality Laundering: Denial-Feedback Leakage in Tool-Calling LLM Agents
Apr 5, 2026Mohammad Hossein ChinaeiAI Agent Security Runtime Enforcement for AI Agents
Independent Researcher
Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code's Auto Mode
Apr 4, 2026Zimo Ji, Zongjie Li, Pingchuan Ma +3AI Agent Security Tool-Use Authorization
Hong Kong University of Science and Technology · ETH Zurich
SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems
Apr 3, 2026KrishnaSaiReddy PatilAI Agent Governance Multi-Agent System Security
APEX: Agent Payment Execution with Policy for Autonomous Agent API Access
Apr 2, 2026Mohd Safwan Uddin, Mohammed Mouzam, Mohammed Imran +1Agentic Commerce Tool Access Control for LLM Agents
Evaluating Privilege Usage of Agents with Real-World Tools
Mar 30, 2026Quan Zhang, Lianhang Fu, Lvsi Lian +5AI Agent Security Benchmarks Tool Access Control for LLM Agents
ECNU Shanghai, China · Xinjiang University Urumqi, Xinjiang, China · Tsinghua University Beijing, China
A Security Analysis of the OpenClaw AI Agent Framework
Mar 29, 2026Surada Suwansathit, Yuxuan Zhang, Guofei GuAI Agent Security Tool Access Control for LLM Agents
SUCCESS Lab, Texas A&M University
AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A
Mar 25, 2026Sunil PrakashAI Agent Security Tool Access Control for LLM Agents
Indian School of Business, India
ClawKeeper: Comprehensive Safety Protection for OpenClaw Agents Through Skills, Plugins, and Watchers
Mar 25, 2026Songyang Liu, Chaozhuo Li, Chenxu Wang +8AI Agent Security LLM Agent Security
Beijing University of Posts and Telecommunications · Beijing Academy of Artificial Intelligence · China Academy of Information and Communications Technology
The Cognitive Firewall:Securing Browser Based AI Agents Against Indirect Prompt Injection Via Hybrid Edge Cloud Defense
Mar 24, 2026Qianlong Lan, Anuj KaulAI Agent Security Prompt Injection Defense
eBay Inc
AgentWall: A Runtime Safety Layer for Local AI Agents
Mar 24, 2026Ashwin AravindAI Agent Safety Runtime Enforcement for AI Agents
Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents
Mar 21, 2026Uchi UchibekeAI Agent Security Tool-Use Authorization
APort Technologies Inc., Toronto, Canada
AC4A: Access Control for Agents
Mar 21, 2026Reshabh K Sharma, Dan GrossmanTool Access Control for LLM Agents LLM Agent Security
University of Washington, Seattle, Washington, USA
Solver-Aided Verification of Policy Compliance in Tool-Augmented LLM Agents
Mar 20, 2026Cailin Winston, Claris Winston, René JustTool Access Control for LLM Agents LLM Agent Verification
University of Washington Seattle, USA
Herding CATs: ALARA for Agent Harness Engineering in Portable Composable Multi-Agent Teams
Mar 20, 2026Christopher J. Agostino, Nayan D'SouzaLLM Agent Harnesses Multi-Agent Systems
NPC Worldwide, Bloomington, IN, USA · Celeria, Inc., Bloomington, IN, USA · Department of Linguistics, Indiana University, Bloomington, IN, USA
PlanTwin: Privacy-Preserving Planning Abstractions for Cloud-Assisted LLM Agents
Mar 19, 2026Guangsheng Yu, Qin Wang, Rui Lang +2AI Agent Security LLM Agent Planning
University of Technology Sydney · CSIRO Data61, Australia
Access Controlled Website Interaction for Agentic AI with Delegated Critical Tasks
Mar 18, 2026Sunyoung Kim, Hokeun KimTool Access Control for LLM Agents AI Agent Security
Arizona State University Tempe, AZ, USA
Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices
Mar 17, 2026Reshabh K Sharma, Linxi Jiang, Shuo Chen +1Tool-Use Authorization Tool Access Control for LLM Agents
University of Washington · The Ohio State University · Microsoft Research
HearthNet: Edge Multi-Agent Orchestration for Smart Homes
Mar 16, 2026Zhonghao Zhan, Krinos Li, Yefan Zhang +1LLM Agent Orchestration Internet of Things
Imperial College London, London, UK · Independent Researcher, Seattle, USA
Agent Privilege Separation in OpenClaw: A Structural Defense Against Prompt Injection
Mar 13, 2026Darren Cheng, Wen-Kwang TsaoPrompt Injection Defense AI Agent Security
TrendAI Lab

May 6, 2026J/K move · Enter open · S save

Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use

Francisco Javier Arceo, Varsha Prasad Narsing

Red Hat AI · Boston, USA

LLM Agent Orchestration AI Agent Security RAG Security Access Control Tool Access Control for LLM Agents

Open paper AskPDF arXiv

Retrieval-Augmented Generation (RAG) and agentic AI systems are increasingly prevalent in enterprise AI deployments. However, real enterprise environments introduce challenges largely absent from academic treatments and consumer-facing APIs: multiple tenants with heterogeneous data, strict access-control requirements, regulatory compliance, and cost pressures that demand shared infrastructure. A fundamental problem underlies existing RAG architectures in these settings: retrieval systems rank documents by relevance--whether through semantic similarity, keyword matching, or hybrid approaches--not by authorization, so a query from one tenant can surface another tenant's confidential data simply because it scores highest. We formalize this gap and analyze additional shortcomings--including tool-mediated disclosure, context accumulation across turns, and client-side orchestration bypass--that arise when agentic systems conflate relevance with authorization. To address these challenges, we introduce a layered isolation architecture combining policy-aware ingestion, retrieval-time gating, and shared inference, enforced through server-side agentic orchestration. This approach centralizes security-critical operations--tool execution authorization, state isolation, and policy enforcement--on the server, creating natural enforcement points for multitenant isolation while allowing client-side frameworks to retain control over agent composition and latency-sensitive operations. We validate the proposed architecture through an open-source implementation in OGX, a vendor-neutral framework that implements an OpenAI-compatible, open-source Responses API with server-side multi-turn orchestration. We evaluate it empirically and show that ABAC gating eliminates cross-tenant leakage while introducing negligible overhead.