Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents
Per-action tool-call guards on LLM agents fail to compose into global policy enforcement — individually approved actions can combine to violate enterprise security policies.
Summary written by editorial AI · Source link below
arXiv:2610.27620v1 Announce Type: new Abstract: Autonomous LLM agents act through tools under per-action authorization: a local guard screens each tool call in isolation. We show that local authorization does not compose into global authorization. A compositional authorization failure (CAF) is a locally authorized execution, or a pair of locally authorized executions, that violates a global policy spanning intent, purpose, provenance, consent, and delegation. We characterize CAFs along two axes
Editorial Analysis
Most enterprises deploying LLM agents rely on per-action guards, but this research shows that approach has a fundamental compositionality gap — policy violations emerge from action sequences, not individual calls.
Audit your LLM agent authorization architecture for compositional failures and implement sequence-level policy enforcement alongside per-action guards.
The most common way enterprises guard AI agents — approving each action individually — has a fundamental flaw: safe actions can combine into policy violations.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the AI Security Desk
- OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication1d
- Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions3d
- You gave your AI agent access, but who is giving it orders?3d
- AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack3d
- Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances3d