access control

To address the challenges of complex security control configuration, difficult policy enforcement, and delayed response in networked systems, this paper proposes a Security Capability Model (SCM). The SCM establishes, for the first time, a computable abstract framework integrating information and data models, formally specifying rule semantics, policy parsing mechanisms, and data representations for filtering- and channel-protection–based controls. Leveraging UML/SysML modeling, Model-Driven Engineering (MDE), and a multi-granularity security control description language, the approach enables automated policy refinement, cross-heterogeneous-device (e.g., firewalls, encrypted gateways) configuration generation, and event-driven response. Experimental evaluation demonstrates a threefold improvement in policy deployment timeliness and a 40% increase in configuration accuracy, thereby filling a critical gap in the formal foundations for automated security policy enforcement.

This work addresses the prevalent issue of over-privileged access control policies that violate the principle of least privilege, often leading to security misconfigurations. To mitigate this, the authors propose a novel method that automatically refines policy rules by analyzing historical access logs and rewriting permission rules in the Amazon Cedar policy language. The approach ensures that system functionality remains unchanged while significantly tightening granted permissions. This study presents the first automated realization of the least privilege principle in practice, demonstrating its effectiveness in two real-world scenarios: it substantially reduces the scope of permitted access, thereby enhancing security, without disrupting normal system operations.

This work addresses the vulnerability of AI agents to malicious inputs or internal errors, which can lead to unauthorized actions and hallucination-induced errors that compromise system security. To mitigate these risks, the paper proposes AgentGuardian, a context-aware adaptive access control framework that monitors agent execution traces to learn legitimate behavioral and input patterns. By integrating real-time input context with control-flow dependencies across multi-step tool invocations, AgentGuardian dynamically constrains agent operations. This approach uniquely combines control-flow analysis with behavioral modeling to effectively defend against agent misuse. Experimental evaluation on two real-world AI agent applications demonstrates that AgentGuardian efficiently detects malicious or misleading inputs, significantly reducing orchestration errors caused by hallucinations while preserving normal functionality.

In 6G intent-driven networks, knowledge-base agents face challenges in achieving secure, fine-grained authorization under dynamic multi-tenant environments. To address this, we propose a context-aware and functionally grounded dynamic access control framework. Our approach innovatively couples agent roles, runtime contextual attributes, and functional semantics to establish a policy-driven, adaptive authorization mechanism. We extend Attribute-Based Access Control (ABAC) with knowledge graph–based modeling, design a context-aware policy engine, and integrate a functional analysis module—enabling real-time, least-privilege, fine-grained authorization. Compared to conventional RBAC, ABAC, and RelBAC models, our framework significantly improves authorization flexibility and security while preserving zero-trust principles. It also enhances the automation efficiency and environmental adaptability of intent-to-configuration translation.

Existing Web data storage platforms struggle to meet the demands of decentralized, semantically rich, and legally compliant data usage control. This work proposes a novel approach that integrates the User-Managed Access (UMA) authorization framework with the W3C Open Digital Rights Language (ODRL) policy language to replace Solid’s native access control mechanism, thereby decoupling authorization from storage. For the first time within the Solid ecosystem, this integration advances access control from mere permission management toward legally aware usage control. The authors also design a policy evaluation mechanism tailored for non-standardized semantic environments. A prototype implementation demonstrates that the proposed method maintains compatibility with Solid while enabling flexible, interoperable, and legally aligned data governance.

Traditional enterprise security models, reliant on static perimeters, struggle to address the dynamic risks introduced by production-grade AI agents operating within authorized workflows. This work proposes the first five-plane reference architecture for runtime governance of AI agents—spanning inference, network, identity, endpoint, and data—and introduces core primitives including arbitrary-point interception, composite subjects with capability decay, and structured audit evidence. By extending policy enforcement from atomic subjects to decay-aware composite subjects, the framework defines six interruption primitives and four correctness invariants. Evaluated across five real-world workflows, it successfully mitigates seven threat classes, achieves microsecond-scale policy decisions, and validates correctness of capability decay, audit reconstructability, and tamper resistance, thereby filling a critical gap in dynamic governance for agent-driven workflows.

This work addresses the absence of a unified, verifiable runtime safety mechanism in existing MCP-style agents, where security decisions are fragmented across multiple components. To bridge this gap, the paper introduces HCP (Handle-Capability Protocol), a runtime framework that, while fully compatible with MCP workflows, formally defines eight execution-layer safety invariants for the first time. HCP enforces these invariants through a fine-grained access control model grounded in subjects, resources, capabilities, handles, and policies, explicitly ensuring critical properties such as subject binding, capability scoping, and data-flow authorization. Empirical evaluation demonstrates that HCP successfully blocks all attacks across ten benchmark scenarios while preserving auditable evidence, substantially outperforming baseline approaches. Microbenchmark results further indicate that policy operations incur an average latency of less than one millisecond.

Enterprise-scale general-purpose agents lack built-in, reusable governance mechanisms for autonomous cross-tool operation, making it difficult to satisfy requirements for compliance, auditability, and behavioral controllability. This work proposes the CUGA policy system, which embeds runtime governance capabilities into five critical checkpoints of the agent execution pipeline—intent protection, playbook guidance, tool invocation control, human approval gating, and output formatting—through a modular “policy-as-code” architecture. Without requiring model fine-tuning, CUGA enables proactive, continuous, and structured behavior control. By integrating typed governance primitives, dynamic playbook injection, and human-in-the-loop approval, the system effectively blocks malicious requests, enforces structured tool sequences, and triggers manual review for high-risk operations in healthcare scenarios, significantly enhancing policy adherence, execution consistency, and deployment safety.

This work addresses the semantic gap faced by current AI agents in enforcing natural language policies: the intended policy semantics are difficult to enforce precisely and interpretably at the system level. To bridge this gap, the authors propose a novel approach that integrates agent-side context with kernel-level enforcement mechanisms. For the first time, policy context is preserved on the agent side, while a domain-specific language (DSL) for information flow control (IFC), implemented via eBPF, enables comprehensive, action-level policy enforcement within the operating system kernel. This framework supports cross-event data-flow and ordering constraints, significantly improving policy compliance rates by covering indirect execution paths invisible to conventional tool-call interception. The system incurs only 1.9%–8.4% runtime overhead and provides semantically clear feedback instead of ambiguous errors.

This work addresses the challenge of governing high-risk actions in heterogeneous multi-agent systems, where runtime disparities hinder consistent enforcement—particularly concerning authorization rationale, approval semantics, and execution evidence. To overcome this, the paper proposes a runtime-agnostic governance model centered on action certificates that supplant vendor-specific logs. The model structures control logic across five critical checkpoints and integrates portable action envelopes, runtime and approval receipts, and replayable proofs. Innovatively, it introduces externality-aware action certificates that embed boundary facts and replace binary approval states with explicit executability categories, enabling unified cross-runtime governance. Evaluation on a benchmark of 96 trajectories spanning four distinct runtimes demonstrates that the approach preserves path quality while revealing distinct failure modes under ablation, effectively supporting runtime-portable governance policies.