policy enforcement

LLM agents are vulnerable to adversarial instructions during external interactions, potentially triggering unauthorized actions and posing severe security risks. To address this, we propose the first programmable least-privilege control framework tailored for LLM agents. Our approach leverages a domain-specific language (DSL) to enforce fine-grained, runtime constraints on tool invocation and provide deterministic fallback mechanisms. It supports user-defined policies, modular integration, and automatic policy generation and dynamic updating by the LLM itself. Balancing security and practicality, our method significantly improves robustness against adversarial attacks across three major benchmarks—AgentDojo, ASB, and AgentPoison—while maintaining high task success rates. Empirical evaluation demonstrates its effectiveness in defending against adaptive attacks, validating both its security guarantees and operational viability.

This work addresses a critical limitation in existing safety mechanisms for large language model (LLM) agents, which often neglect the contextual dependence of agent behaviors and struggle to balance safety with utility. The authors formally define context-sensitive safety through four verifiable properties: task alignment, action alignment, source authorization, and data isolation. They introduce oracle functions to dynamically detect violations of these properties during execution. By integrating formal modeling, information flow control, and runtime verification, the framework provides contextualized definitions for attacks such as prompt injection and jailbreaking, and unifies existing defense strategies under a coherent theoretical structure. Experimental results demonstrate that diverse known attacks can be precisely characterized as instances of property violations, establishing a foundational basis for designing LLM agent defenses that jointly ensure safety and practical effectiveness.

This work addresses the lack of comprehensive governance mechanisms—such as permissions, prohibitions, obligations, exemptions, and policy conflict resolution—in existing autonomous agent systems for cross-organizational collaboration. To bridge this gap, the authors propose AgenticRei, a novel framework that, for the first time, integrates obligation lifecycle management, context-aware exemptions, and policy conflict resolution within a unified runtime governance architecture. The framework formalizes deontic policies using an OWL ontology and leverages the Rei policy language coupled with a high-performance logical reasoning engine to enable dynamic policy inference. AgenticRei seamlessly aligns with industry standards like A2AS and successfully enforces security and privacy constraints that current production-grade policy engines struggle to handle, thereby significantly enhancing both the expressiveness and practical feasibility of agent governance in complex, real-world scenarios.

This work addresses the challenge of ensuring deterministic policy enforcement in large language model (LLM) agents operating within complex authorization scenarios—such as customer service, approval workflows, and data access control—where conventional approaches often fail to guarantee compliance. To this end, we propose PCAS, the first policy compiler for agent systems, which models system state via dependency graphs, expresses policies declaratively using Datalog rules, and integrates a reference monitor to intercept policy-violating actions prior to execution. By decoupling policy enforcement from model inference and embedding compliance directly into system construction, PCAS automatically synthesizes policy-compliant agent systems without requiring security-oriented redesign. Evaluation across three real-world scenarios demonstrates that our approach increases policy compliance from 48% to 93% and achieves zero runtime violations.

This work addresses the semantic gap faced by current AI agents in enforcing natural language policies: the intended policy semantics are difficult to enforce precisely and interpretably at the system level. To bridge this gap, the authors propose a novel approach that integrates agent-side context with kernel-level enforcement mechanisms. For the first time, policy context is preserved on the agent side, while a domain-specific language (DSL) for information flow control (IFC), implemented via eBPF, enables comprehensive, action-level policy enforcement within the operating system kernel. This framework supports cross-event data-flow and ordering constraints, significantly improving policy compliance rates by covering indirect execution paths invisible to conventional tool-call interception. The system incurs only 1.9%–8.4% runtime overhead and provides semantically clear feedback instead of ambiguous errors.

This work addresses the security threat posed by external tools that, while appearing benign at their interfaces, may embed malicious behaviors when invoked by large language model agents. To mitigate this risk, the authors propose ToolGuardian, a novel framework featuring a declarative policy layer based on Answer Set Programming. This layer explicitly models tool capabilities, effects, task context, and compositional relationships to enable auditable, deterministic pre-execution screening and runtime task-aware authorization. By integrating progressive tool representations—including natural-language descriptions, system call traces, simulated executions, and source code analysis—with logical reasoning, ToolGuardian achieves an F1 score of 0.86 and 88% accuracy in admission control across 16 MCP tools (including eight malicious variants) and 20 diverse scenarios, and attains 100% classification accuracy during runtime authorization.

This work addresses the lack of system-level support in existing large language model (LLM) agents for long-running execution, state persistence, access control, and auditability, as well as the common misconception of treating tool invocations as trust boundaries. Inspired by library operating systems, the paper proposes a novel runtime environment that models LLM agents as AgentProcesses endowed with identity, lifecycle management, and capability-based access control. Authorization and isolation are enforced through runtime primitives rather than tool dispatching. Key innovations include a capability-based security model, a human approval queue, checkpointing mechanisms, and comprehensive audit logging. The system features asynchronous scheduling, namespace-isolated object memory, just-in-time tool registration, and an injectable resource layer. A prototype implementation passes 123 regression tests and real-model evaluations, supporting working directories, shell primitives, and one-time permission grants to ensure secure and controllable long-term operation.

This study addresses the challenge that large language model (LLM) agents struggle to consistently adhere to enterprise policies across multi-turn dialogues, as existing external monitoring mechanisms often fail to intervene effectively due to insufficient contextual understanding. To tackle this, the work formulates policy compliance as a dialogue-level task and introduces a context-aware sub-agent verifier that shares the main agent’s conversational perspective. By jointly reasoning over dialogue history and policy rules, the verifier generates tailored compliance-preserving action recommendations. Integrated into mainstream LLM systems—including GPT, Claude, and Gemini—the proposed architecture demonstrates substantial performance gains on the tau²-BENCH aviation dataset, improving the PASS4 metric by 6.0–12.0 percentage points on average, achieving higher violation recall, and reducing intervention frequency by approximately 50%.

Existing policy specification languages struggle to express access control policies in multilayered defense architectures with fine-grained precision, particularly due to their limited support for contextual information such as dynamic application states. This work proposes a Datalog-based declarative policy language that, for the first time, incorporates rich contextual data—including runtime application states—into access control decisions. The language enables expressive, fine-grained authorization rules and complex conditional logic through a declarative formalism. By reformulating SELinux policies within this framework, the study demonstrates the language’s superior expressiveness and effectiveness in capturing and enforcing sophisticated security policies, thereby addressing critical limitations of current approaches in representing context-aware, multilayered access control.

This work addresses a critical security vulnerability in large language model (LLM) agents, which may execute persistent operations based on stale authorization credentials. To mitigate this risk, the authors propose a “commit-time authorization” mechanism that dynamically validates the freshness, causal ordering, binding integrity, and eligibility of authorization evidence at operation commit boundaries. They formally define and verify the security properties of this mechanism, demonstrating that successful task completion does not necessarily imply valid authorization. Furthermore, they design CommitGuard, a runtime enforcement system, and evaluate it using a controlled test suite spanning browser interactions, tool/API invocations, and multi-agent workflows. Across 54 tasks and 270 runs, only 55 executions achieved genuine authorization; experiments confirm that CommitGuard effectively blocks operations relying on expired credentials, underscoring authorization commit as an essential security property.