Tool Access Control for LLM Agents

This field studies how to ensure an LLM agent uses only the tools and permissions justified by a user's task, across settings such as APIs, browsers, coding environments, and MCP-based systems. Common approaches include task-scoped least-privilege policies, capability-based delegation, provenance and information-flow tracking, and runtime gateways that check calls before execution or commit; human approval is often reserved for consequential actions. Evidence shows that prompts and static tool allowlists can leave gaps, especially when calls change meaning across steps, permissions persist, or authorization is not bound to the exact action and current state. A central challenge is balancing strong, verifiable restrictions with useful autonomy, while evaluating both unauthorized effects and unnecessary denials in realistic, long-running workflows.