Per-action checks miss relational policy violations in LLM agents
Original title: Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents
A SAT/SMT synthesizer produces witnesses that per-action monitors approve but paired-execution review flags.
Researchers argue that screening each LLM tool call alone does not enforce policies spanning intent, purpose, provenance, consent and delegation. Relational purpose violations are a 2-safety property with no single-trace point of blame, so a no-false-alarm per-action monitor detects none of them. AL-SYNTH, which uses no language model, emits minimal witnesses; nine LLM judges almost always approved them one at a time but flagged them together. None of six surveyed guardrails compares executions.
- Each synthesized witness is checked against an exhaustive oracle.
- Per-action blocking of witnesses matched a benign control.
- The impossibility result does not depend on the model.
- Monitors must compare executions or accept false alarms.
From the original article
1 min read at arxiv.orgAutonomous LLM agents act through tools under per-action authorization: a local guard screens each tool call in isolation. We show that local authorization does not compose into global authorization. A compositional authorization failure (CAF) is a locally authorized execution, or a pair of locally authorized executions, that violates a global policy spanning intent, purpose, provenance, consent, and delegation.
By Anmol Pandey · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.