Tool Access Control for LLM Agents

LLM: Large Language Model

This field studies how to ensure an LLM agent uses only the tools and permissions justified by a user's task, across settings such as APIs, browsers, coding environments, and MCP-based systems. Common approaches include task-scoped least-privilege policies, capability-based delegation, provenance and information-flow tracking, and runtime gateways that check calls before execution or commit; human approval is often reserved for consequential actions. Evidence shows that prompts and static tool allowlists can leave gaps, especially when calls change meaning across steps, permissions persist, or authorization is not bound to the exact action and current state. A central challenge is balancing strong, verifiable restrictions with useful autonomy, while evaluating both unauthorized effects and unnecessary denials in realistic, long-running workflows.

Latest papers

222 papers42 papers in the last four weeks, up 8% on the four weeks before. 0.2% of all new papers.

Janus: a Playground for User-Involved Agentic Permission Management
Jul 1, 2026Natalie Grace Brigham, Eugene Bagdasarian, Tadayoshi Kohno +1AI Agent Security Human-AI Decision Making
University of Washington · University of Massachusetts Amherst · Georgetown University
ClawArena-Team: Benchmarking Subagent Orchestration and Dynamic Workflows in Language-Model Agents
Jun 30, 2026Kaiwen Xiong, Haonian Ji, Shi Qiu +4LLM Agent Orchestration LLM Agent Evaluation
1UNC-Chapel Hill · University of California, Berkeley · University of California, Santa Cruz
Behavioral Governance for Autonomous AI Agents: The AgentBound Framework
Jun 29, 2026Anuj Kaul, Qianlong Lan, Pranay GuptaAI Accountability AI Agent Governance
eBay Inc. · Independent Researcher
ATM: CID-Brokered Pre-Write Admission for Multi-Agent Code Co-Synthesis
Jun 29, 2026Eagl HuangMulti-Agent Coordination Software Engineering Agents
Eagl Huang
From Tool Connection to Execution Control: Benchmarking Security Invariants in MCP-Style Agent Runtimes
Jun 27, 2026Ting LiuMCP Security LLM Agent Security
SymbolicLight Research Foshan, Guangdong, China
Agent Safety Is Action Alignment
Jun 27, 2026Shawn Li, Yue ZhaoLanguage Model Safety Evaluation AI Alignment
University of Southern California · Los Angeles, California, USA
Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks
Jun 27, 2026David Mellafe ZuvicAI Agent Auditing LLM Auditing
Independent Security Research Chile
Why Trust Your Agent? Empirical Security Gains from TRiSM-Guided Agentic Workflows in Healthcare
Jun 27, 2026Liam KearnsMedical Report Generation RAG Poisoning Attacks
AuraQ Malvern Worcestershire UK
A Deterministic Control Plane for LLM Coding Agents
Jun 25, 2026Padmaraj MadathaAI Coding Agents LLM Guardrails
HappiestJuneMinds2026 Technologies (AIP Centre of Excellence)
The Unfireable Safety Kernel: Execution-Time AI Alignment for AI Agents and Other Escapable AI Systems
Jun 24, 2026Seth Dobrin, Łukasz ChmielAI Alignment AI Agent Security
ARYA Labs PBC
Intent-Governed Tool Authorization for AI Agents
Jun 22, 2026Genliang Zhu, Chu WangAI Agent Security AI Agent Governance
Accentrust · Georgia Institute of Technology · University of Illinois Urbana-Champaign
Harness-MU: A Safe, Governed, and Effective Harness for Multi-User LLM Agents
Jun 20, 2026Wangxuan Fan, Xiaoyu Nie, Zhongxiang DaiPrivacy-Preserving Language Models LLM Agent Security
The Chinese University of Hong Kong, Shenzhen
When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agents
Jun 18, 2026Kaiyue Yang, Yuyan Bu, Jingwei Yi +5LLM Agent Security AI Agent Security Benchmarks
Institute of Information Engineering, Chinese Academy of Sciences · Beijing Academy of Artificial Intelligence · The Chinese University of Hong Kong +2
GateMem: Benchmarking Memory Governance in Multi-Principal Shared-Memory Agents
Jun 17, 2026Zhe Ren, Yibo Yang, Yimeng Chen +7LLM Agent Memory Agent Memory Governance
School of Artificial Intelligence, Jilin University · 2Shanghai Jiao Tong University · 3King Abdullah University of Science and Technology (KAUST) +2
SecureClaw: Clawing Back Control of LLM Agents
Jun 8, 2026Yuhan Ma, Stefan SchmidData Leakage LLM Agent Security
TU Berlin
AgentTrust: A Self-Improving Trust Layer for AI-Agent Actions
Jun 7, 2026Chenglin YangAI Agent Reliability LLM-as-a-Judge
Independent Researcher
Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals
Jun 4, 2026Thamilvendhan MunirathinamLLM Agent Evaluation LLM Refusal Behavior
Agent libOS: A Runtime Substrate for Capability-Controlled Self-Evolving LLM Agents
Jun 2, 2026Yingqi ZhangAI Agent Security LLM Agents
Department of Computer Science and Technology, Tsinghua University Beijing, China
Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI
Jun 2, 2026Amjad Ibrahim, Yong LiAI Accountability AI Agent Security
Huawei Heisenberg Research Center Germany
ToolGate: Token-Efficient Pre-Call Control for Tool-Augmented Vision-Language Agents
Jun 2, 2026Anjie Liu, Yan Song, Zhixun Chen +3Tool Use in VLMs Tool-Augmented Language Model Agents
The Hong Kong University of Science and Technology (Guangzhou) · University College London · AI Lab, The Yangtze River Delta
AgentRedBench: Dynamic Redteaming and Integration-Aware Defense for LLM Agents over SaaS Integrations
Jun 1, 2026Hiskias Dingeto, William LeeneyLLM Red Teaming LLM Agent Security
StackOne Technologies
AIRGuard: Guarding Agent Actions with Runtime Authority Control
May 27, 2026Suliu Qin, Haomin Zhuang, Yujun Zhou +2AI Agent Security Tool-Using Agents
University of Liverpool · University of Notre Dame · 2Inria, France
FinHarness: An Inline Lifecycle Safety Harness for Finance LLM Agents
May 26, 2026Haoxuan Jia, Yang Liu, Bin Chong +10AI Agent Reliability LLM Guardrails
Nanyang Technological University · Tsinghua University · Peking University +8
Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks
May 18, 2026Yubin Qu, Ying Zhang, Yanjun Zhang +4Tool Access Control for LLM Agents Computer-Use Agent Benchmarks
Griffith University · Wake Forest University · Nanyang Technological University +2
Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control
May 18, 2026Rohith UppalaLLM Agent Security AI Control
Independent Researcher
Do Coding Agents Understand Least-Privilege Authorization?
May 14, 2026Zheng Yan, Jingxiang Weng, Charles Chen +9Software Engineering Agents AI Agent Security
Evolvent AI Research Team
Options, Not Clicks: Lattice Refinement for Consent-Driven MCP Authorization
May 12, 2026Ying Li, Yanju Chen, Peiran Wang +4MCP Security Tool-Use Authorization
University of California, Los Angeles USA · University of California, San Diego USA · University of Texas at Arlington USA +1
The Granularity Mismatch in Agent Security: Argument-Level Provenance Solves Enforcement and Isolates the LLM Reasoning Bottleneck
May 11, 2026Linfeng Fan, Ziwei Li, Yuan Tian +3LLM Agent Security Information Flow Control
Gaoling School of Artificial Intelligence, Renmin University of China, Beijing, China · King Abdullah University of Science and Technology, Thuwal, Saudi Arabia · Dongbei University of Finance and Economics, Dalian, China +1
FORTIS: Benchmarking Over-Privilege in Agent Skills
May 9, 2026Shawn Li, Chenxiao Yu, Han Wang +8LLM Agent Security AI Agent Security Benchmarks
University of Southern California · University of Illinois at Urbana-Champaign · 3Adobe Research +3
TeamBench: Evaluating Agent Coordination under Enforced Role Separation
May 8, 2026Yubin Kim, Chanwoo Park, Taehan Kim +9Multi-Agent Coordination LLM Agent Evaluation
MIT · Google Research · Independent Researcher +1

Jul 1, 2026J/K move · Enter open · S save

Janus: a Playground for User-Involved Agentic Permission Management

Natalie Grace Brigham, Eugene Bagdasarian, Tadayoshi Kohno, Franziska Roesner

University of Washington · University of Massachusetts Amherst · Georgetown University

AI Agent Security Human-AI Decision Making Tool Access Control for LLM Agents

Open paper AskPDF arXiv

AI agents that autonomously execute tool calls on a user's behalf raise pressing questions about permission management: what role could users play, and what role should they play? Despite many proposed approaches, the user's role in agentic permission management remains underexplored. We introduce Janus, a playground system for implementing and evaluating user-involved agentic permission management designs. Janus consists of two components: Janus-Core, a modular agentic system supporting a diverse spectrum of permission management designs, and Janus-Harness, an automated evaluation framework. Grounded in a conceptual model that identifies key design axes for user involvement, we implement six permission assistants spanning the design space and evaluate them across three scenarios with four subscenarios each and three synthetic responders. We demonstrate that user involvement is critical and can strengthen privacy and security and that user behavior such as permission fatigue must be accounted for in system design. No single design performs optimally across all contexts, motivating a more principled and context-sensitive approach to deploying permission assistants in agentic systems. Janus is publicly available to support future investigation into this dimension of agentic system design.