Many minimal agent tool grants cannot be ranked
Original title: Incomparable Minima in Agent Tool Authorization
For 29.8–33.3% of Microsoft Graph tasks, minimal sufficient grants form an antichain with no smaller choice.
A paper tests whether two tool grants that both let an agent finish a task can be ordered by privilege. Across authorization tables covering 22,305 Microsoft Graph endpoint bindings and 23,852 Google API methods, many tasks have several minimal grants, none of which is a subset of another. Shipped or reconstructed privilege scales rate most of those pairs equal, and four risk measures often rank the same pairs in opposite directions. Six unnamed frontier models usually pick a minimal grant but often not one that is smallest on every measure.
Unconfirmed: Results are the authors' measurements; the six frontier models are not named.
- Google resource tasks were incomparable in 3.2% of cases.
- Microsoft privilegeLevel rated 67.4–74.4% of incomparable Graph pairs equal.
- A verb-based ladder rated 89.0–92.0% of Graph pairs and 92.0% of Google pairs equal.
- Models chose a minimal grant on 99.0% of 1,708 decisions and an all-measure minimum on 66.7%.
- On 22.1% of decisions, another option matched or beat the chosen grant on every measure.
- Products
- Microsoft GraphGoogle API
From the original article
1 min read at arxiv.orgAn agent that needs a tool needs authority to call it, and every proposal for governing that authority has to answer one question: of two grants that both let the agent finish a task, which one is smaller? Over-privilege benchmarks score agents against this answer, and permission solvers compute it.
By Xin Xu · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.