Does an AI Agent's Authorization Actually Bind the Action That Reaches the Executor?

Описание и применение

Автор исследовал, что решение об авторизации агента может не привязываться к фактическому выполнению действия, и создал AgentGuard, который гарантирует, что авторизованное действие совпадает с выполненным, проверяя целостность, исключительность границы и свежесть полномочий.

Задача

When an agent is authorized to perform an action, there is no guarantee that the same action is what eventually gets executed, leading to potential security gaps.

Результат

AgentGuard passed 39/39 tests, demonstrating that it can enforce action integrity, boundary exclusivity, and authority freshness. Existing frameworks may or may not provide similar guarantees; the experiment invites community feedback.

Рабочий процесс

• Identify a consequential tool in the agent system
• Locate where authorization occurs
• Document the exact authorized action (tool, arguments, target, identity, context, policy state, expiry)
• Introduce a material change between authorization and execution (e.g., modify arguments, target, identity, or callable)
• Observe whether the system rejects the modified action

Доказательства

The subsequent independent adversarial retest covered things such as argument changes, target changes, agent identity, runtime identity, capability substitution, replay, expiry, stale policy state, and legitimate execution. It passed 39/39 tests.

Источник