Tool-Use Authorization

Follow this topic Ask about this topic

Tool-use authorization controls whether an agent’s specific tool call is permitted, rather than merely which tools it can access. Common approaches include deterministic policy gateways, task-scoped credentials, intent certificates, and checks that compare proposed actions with trusted evidence before execution or at commit. Evaluations use adversarial tool-use scenarios, AgentDojo-derived tasks, and MCP traces to test both blocking unauthorized actions and allowing legitimate ones. A central challenge is balancing strict, fail-closed controls with useful autonomy, especially when tasks evolve, tool results change, or actions are retried.

Latest papers

26 papers4 papers in the last four weeks, against 1 the four weeks before. 0.0% of all new papers.

Permission to Retry: A Study of Authorization and Recovery in AI Agent Workflows
Oct 22, 2026Deekshith Marla, Kushagra BhatnagarAI Agent Reliability Tool-Use Authorization
Same Operation, Different Permission: Evaluating Whether Guardrails Honor Authorization
Oct 12, 2026Huihao Jing, Shaojin Chen, Wenbin Hu +5LLM Guardrails Tool-Use Authorization
HKUST
Runtime Authorization of Self-Generated Subgoals in Long-Horizon Tool-Using AI Agents
Oct 4, 2026Genliang Zhu, Chu WangRuntime Enforcement for AI Agents Tool-Use Authorization
Accentrust, Vancouver, Canada · Georgia Institute of Technology, School of Computer Science, Atlanta, Georgia, USA · University of Illinois Urbana-Champaign, Department of Computer Science, Urbana, Illinois, USA
ActionGuard: Tool Call Authorization under Poisoned Skills
Sep 30, 2026Jihun Han, Yejin Jang, Byung Il Kwak +1Runtime Enforcement for AI Agents Prompt Injection Defense
Korea University Republic of Korea
Runtime Authorization for Resources Acquired by AI Agents
Sep 13, 2026Genliang Zhu, Chu WangAI Agent Security Runtime Enforcement for AI Agents
Accentrust · Georgia Institute of Technology · Accentrust, Vancouver, Canada +3
Influence Is Not Authority: When Causal Guardrail Signals Make Legitimate Tool Use Look Like an Attack in Tool-Using LLM Agents
Aug 30, 2026Tanzim Ahad, Ismail Hossain, Md Jahangir Alam +3LLM Guardrails LLM Agent Security
Department of Computer Science, University of Texas at El Paso, TX, USA 79902 · Department of Computer Science and Engineering, New Mexico Tech, Socorro, NM, USA 87801 · University of Illinois Urbana-Champaign, IL, USA
AID-Guard: Stateful Authorization for Delegated Agent Effects
Aug 21, 2026Yingzhe Tong, Leyu Dai, Songhui GuoAI Agent Security Tool-Use Authorization
Information Engineering University
A Gateway Architecture for Enterprise MCP Authentication: Unifying Heterogeneous Auth, Identity Delegation, and the User / Non-User Persona Problem
Aug 11, 2026Suraj Kumar, Amy Wang, Srinivasan ManoharanMCP Security Tool-Use Authorization
Enterprise AI Platform Engineering
Explanation-Bound Tool Execution for AI Agents: Server-Verified Action Claims Without Trusting Model Rationales
Jul 28, 2026Genliang Zhu, Chu WangLLM Agent Security LLM Agent Verification
Accentrust · Georgia Institute of Technology · University of Illinois Urbana-Champaign
Are You Still the Agent I Authorized? Earned Authority under a Fixed Ceiling for Evolving Agents
Jul 26, 2026Zhaoxi Zhang, Xiaomei ZhangTool-Use Authorization Tool Access Control for LLM Agents
University of Technology Sydney · Griffith University
Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks
Jun 27, 2026David Mellafe ZuvicAI Agent Auditing LLM Auditing
Independent Security Research Chile
Governing Actions, Not Agents: Institutional Attestation as a Governance Model for Autonomous AI Systems
Jun 24, 2026Jakob Salfeld-NebgenAI Agent Safety AI Agent Governance
Intent-Governed Tool Authorization for AI Agents
Jun 22, 2026Genliang Zhu, Chu WangAI Agent Security AI Agent Governance
Accentrust · Georgia Institute of Technology · University of Illinois Urbana-Champaign
AgentTrust: A Self-Improving Trust Layer for AI-Agent Actions
Jun 7, 2026Chenglin YangAI Agent Reliability LLM-as-a-Judge
Independent Researcher
Insuring Every Action: An Authority Frontier Framework for Runtime Actuarial Control of Autonomous AI Agents
May 25, 2026Hao-Hsuan ChenAI Risk Management AI Agent Evaluation
Department of Risk Management and Insurance National Chengchi University
Attested Tool-Server Admission: A Security Extension to the Model Context Protocol
May 22, 2026Alfredo MetereMCP Security AI Agent Security
Enclawed LLC
Hallucination as Exploit: Evidence-Carrying Multimodal Agents
May 18, 2026Guijia Zhang, Hao Zheng, Harry YangAI Agent Security Multimodal Hallucination
1Shenzhen University · 2HKUST
Digital Identity for Agentic Systems: Toward a Portable Authorization Standard for Autonomous Agents
May 12, 2026Partha MadhiraAI Agent Security AI Agent Governance
Options, Not Clicks: Lattice Refinement for Consent-Driven MCP Authorization
May 12, 2026Ying Li, Yanju Chen, Peiran Wang +4MCP Security Tool-Use Authorization
University of California, Los Angeles USA · University of California, San Diego USA · University of Texas at Arlington USA +1
SUDP: Secret-Use Delegation Protocol for Agentic Systems
Apr 27, 2026Xiaohang Yu, Hejia Geng, Xinmeng Zeng +1Cybersecurity LLM Agent Security
Imperial College London · Science Intelligence · University of Oxford +1
Right-to-Act: A Pre-Execution Non-Compensatory Decision Protocol for AI Systems
Apr 27, 2026Gadi LaviTool-Use Authorization AI Governance
Independent Researcher, DECIMAG
Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code's Auto Mode
Apr 4, 2026Zimo Ji, Zongjie Li, Pingchuan Ma +3AI Agent Security Tool-Use Authorization
Hong Kong University of Science and Technology · ETH Zurich
Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents
Mar 21, 2026Uchi UchibekeAI Agent Security Tool-Use Authorization
APort Technologies Inc., Toronto, Canada
Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices
Mar 17, 2026Reshabh K Sharma, Linxi Jiang, Shuo Chen +1Tool-Use Authorization Tool Access Control for LLM Agents
University of Washington · The Ohio State University · Microsoft Research
ILION: Deterministic Pre-Execution Safety Gates for Agentic AI Systems
Feb 22, 2026Florin Adrian ChitanAI Agent Safety Tool-Use Authorization
Independent AI Safety Researcher
OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access
Feb 22, 2026Genliang Zhu, Chu Wang, Ziyuan Wang +2Tool Access Control for LLM Agents AI Agent Governance
Accentrust · Georgia Institute of Technology · University of Illinois Urbana-Champaign +2

Oct 22, 2026J/K move · Enter open · S save

Permission to Retry: A Study of Authorization and Recovery in AI Agent Workflows

Deekshith Marla, Kushagra Bhatnagar

AI Agent Reliability Tool-Use Authorization Runtime Enforcement for AI Agents

Open paper AskPDF arXiv

A durable agent can resume a consequential action while its authority changes and the action's external outcome remains uncertain. We study execution-time reliability of tool-using AI agents, isolating recovery decisions from language-model behavior. Checkpoint state, permission to dispatch, evidence of an external effect and permission to reconcile are distinct obligations. We present a finite conformance study that checks these obligations through histories scored against a provider effect ledger hidden from the recovering application. A prospectively frozen campaign executes 336 histories on native LangGraph and Temporal hosts, crossing 14 schedules, three provider contracts and four matched application policies. All 168 paired host cells have identical checked outcomes. Per host, retained-ledger reconciliation passes all 42 histories: 21 checked completions, 15 denials and six unknown outcomes with reservations retained. Cached retry, revalidation before retry and stable-key retry pass 30, 36 and 31 histories respectively. A separate 16-case component study of InfinityOS, an enterprise AI platform developed by Arya.ai, exercises exported authority, worker, recovery and settlement code over repository fakes. The results isolate the roles of current authority, provider contracts and retained observations in recovery, with safety, completion and unresolved obligations reported separately for the declared application profile.