LATIDIA · Ciberseguridad

Permitir local, denegación global: por qué la autorización por acción no se compone en los agentes de LLM

arXiv: 2610.27620v1Tipo de anuncio: nuevo Resumen: Los agentes autónomos de LLM actúan a través de herramientas bajo autorización por acción: un guardia local filtra cada llamada de herramienta de forma aislada. Demostramos que la autorización local no compone

La noticia

arXiv:2610.27620v1 Announce Type: new Abstract: Autonomous LLM agents act through tools under per-action authorization: a local guard screens each tool call in isolation. We show that local authorization does not compose into global authorization. A compositional authorization failure (CAF) is a locally authorized execution, or a pair of locally authorized executions, that violates a global policy spanning intent, purpose, provenance, consent, and delegation. We characterize CAFs along two axes, expressiveness (single-trace safety versus relational k-safety) and observability (a ladder of monitor profiles). Our central result is an impossibility: relational purpose violations form a 2-safety hyperproperty with no per-trace locus of blame, so a per-action monitor that never raises a false