FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs

2026-07-29

AI Summary

This work addresses the challenge that static permission mechanisms are insufficient to meet context- and dataflow-sensitive security authorization requirements for large language model (LLM) agents operating in dynamic environments. To this end, the paper proposes the FAVA framework, which first leverages an LLM to translate natural language tasks into structured permission constraints, constructing an evidence-backed permission graph that explicitly tracks contextual dependencies and data flows. The framework then employs an SMT solver to formally verify the safety of this permission graph and enforces interpretable authorization decisions at runtime via a dedicated gateway. By integrating LLM-driven intermediate permission representations with formal verification, FAVA establishes a novel context- and dataflow-aware dynamic authorization mechanism, achieving a 90.5% policy compliance rate on the OpenAgentSafety, OctoBench, and ActPlane benchmarks and effectively blocking unauthorized execution trajectories.

Abstract

Large language model (LLM) agents autonomously interleave semantic reasoning with complex system operations. In these dynamic environments, static tool-level permissions are fundamentally insufficient; safe authorization is highly context-dependent and heavily reliant on evolving runtime states and data flows. We present FAVA (Formal Authorization for Verified Agents), a permission-carrying authorization framework for agent execution. FAVA utilizes an LLM-guided Permission Intermediate Representation (IR) to translate ambiguous natural-language tasks into structured constraints. A deterministic lowering pass then converts this IR into an evidence-backed permission graph that explicitly tracks data flows, dependencies, and contextual labels. To provide strict security guarantees, a Satisfiability Modulo Theories (SMT) authorizer mathematically verifies the current graph against security policies before any effectful action executes. A runtime gateway then enforces the solver's result, either authorizing the execution or intercepting it with a precise counterexample. We evaluate FAVA across OpenAgentSafety, OctoBench, and ActPlane scenarios. Our evaluation demonstrates that FAVA achieves a 90.5% Decision Compliance Rate (DCR) over the aggregate dataset, successfully intercepting dynamic violating traces in the evaluated trace-conditioned scenarios.

Problem

• authorization
• large language model agents
• context-dependent security
• dynamic permissions
• runtime data flows

Innovation

• Formal Authorization
• Permission Graph
• SMT Verification
• LLM-guided IR
• Runtime Security Enforcement