PaperlayerView exact revision on arXiv

Source-linked AI summary

Task-Conditioned Least-Privilege Learning for Executable Terminal and MCP Agents

Alexander Tu, Michael Tu

arXiv:2608.18351v1cs.CRcs.AIcs.LGeess.SY

TL;DR

Tool-using agents may exercise more authority than tasks require, while permission gates alone can miss equivalent or unrelated access paths. This paper trains least-privilege behavior with audited, task-specific authority and finds substantially safer task completion while retaining capability.

  • Problem

    Permission gates can miss equivalent risky actions or grant unrelated access, motivating learned least-privilege behavior for tool-using agents.

  • Method

    The framework optimizes task-relative excess privilege using six-dimensional risk assessment, pre- and post-action audits, and deterministic verifiers in terminal and MCP environments.

  • Results

    98.48% safe success versus 64.36% for the base policy, while successful excess-authority events fell from 4.56% to 0.79% across 500 tasks.

  • Takeaways & Limitations

    Least-privilege-aware post-training can add a useful control layer while retaining tool competence, but explicit prompting may matter in unfamiliar environments.

  • Takeaways & Limitations

    The largely synthetic task set does not establish performance on unrestricted production repositories or services, and its authority judgments may be imperfect.

Abstract

from arXiv · show

Tool-using large language-model agents can complete a task while exercising authority that the user did not grant or the task does not need, causing excess-authority errors. Traditional permission gating systems alone for validating agent environments are insufficient. We study whether post-training can teach a 4B-parameter model to choose task-conditioned authority in executable terminal and Model Context Protocol (MCP) environments to complement those measures. We propose a framework where each action is audited before execution and again from observed effects along six dimensions of risk. This auditing is conducted using deterministic verifiers that score completion, evidence, exact state, prohibited attempts, and safe success. In conjunction with predefined task-specific sufficient-authority envelopes, we determine task-specific excess privilege values for trajectories, which are then optimized for in post-training. We find that after training using this framework on Qwen3.5-4B over 1,500 tasks, the selected seed reaches 98.48% safe success across 2,896 evaluation episodes spanning all 500 held-out tasks, compared with 64.36% for the base policy, and reduces excess-authority error events from 4.56% to 0.79%. Furthermore, external tests show capability retention and prompt-directed improvement. A 400 task continuation study also found evidence of generalization, reducing excess-authority events by 6.99 percentage points while maintaining previous capabilities. We conclude learned restraint through least-privilege aware post-training is therefore useful as an additional control layer for tool-using agents in executable terminal and MCP environments, but it does not replace permission gates and sandboxing.

I. INTRODUCTION · II. LITERATURE REVIEW

The paper frames task-relative excess authority as a distinct failure mode for tool-using agents and proposes least-privilege-aware post-training with deterministic, trajectory-level auditing. It positions this framework against permission-inference and tool-selection benchmarks while grounding optimization in verifiable outcomes.

  • I. INTRODUCTION: Tool-using agents can complete tasks while reading unrelated records, editing outside scope, or using unnecessarily authoritative tools.These behaviors can create unintended side effects or violate the request even when the final answer or state is correct.
  • I. INTRODUCTION: Task-relative excess-authority errors exercise authority beyond the reasonably sufficient minimum for a requested task.Trajectories may therefore be over-privileged despite producing a correct final answer or state.
  • I. INTRODUCTION: Permission gates are insufficient alone because coverage can depend on learned risk associations, equivalent state changes may bypass gates, and required access may be omitted.The paper motivates learned restraint as a complement to, rather than replacement for, permission controls.
  • I. INTRODUCTION: The framework measures least privilege through shown capabilities, permitted actions, and actual authority and effects.An unseen broker deterministically parses proposed actions, assesses execution risk, selects execution mode, records effects, and supports task-specific sufficient-authority envelopes.
  • I. INTRODUCTION: The study trains Qwen3.5-4B with LoRA and direct Dr. GRPO on a 1,500-task executable curriculum, requiring task completion alongside appropriate privilege.Policies are evaluated on validation sets, ablations, and external benchmarks.
  • I. INTRODUCTION: The paper contributes six-dimensional privilege classification, brokered terminal and MCP environments with pre- and post-execution auditing, and a deterministic excess-authority evaluation dataset.The design aims to measure authority across different tasks and environments, including those not used for training.
  • II. LITERATURE REVIEW: Unlike prior work focused on permission inference or individual tool choice, this environment measures trajectory authority from arguments, current state, and observed effects.This framing treats terminal commands and MCP calls as context-dependent rather than intrinsically fixed-authority actions.
  • II. LITERATURE REVIEW: Related benchmarks identify authorization failures, privilege-boundary violations, unnecessary escalation, and general tool-use capability, while this work applies direct Dr. GRPO with deterministic outcome-based rewards.The reward measures task success, evidence, environment state, prohibited attempts, and excess authority instead of relying on dynamic judging; Dr. GRPO removes generated-length and group-standard-deviation normalization.

III. METHODOLOGY · A. Task Relative Authority

The methodology models each task trajectory through six authority dimensions, audits risk before and after actions, and compares observed authority with a reviewed task-specific sufficient-authority envelope. Strict verifiers assess success, evidence, exact state, prohibited effects, and safe execution in resettable environments.

  • A. Task Relative Authority: Each task trajectory consists of terminal commands, MCP calls, categorical human escalations, and a final answer, with every action assigned a six-dimensional authority vector.The trajectory is represented as τ = (a1, o1, . . . , aT, oT).
  • A. Task Relative Authority: The six dimensions cover state mutation, dynamic execution, environment-boundary reach, sensitive-data access, breadth of effects, and persistence beyond the intended operation.Trajectory risk records the largest value reached on each dimension across all actions.
  • A. Task Relative Authority: Risk for each action is the componentwise maximum of pre-action and post-action assessments, capturing both attempted authority and resulting environment effects.This also captures authority attempted when a command is blocked.
  • A. Task Relative Authority: Each task receives a reviewed sufficient-authority envelope zreq(x), and only authority exceeding that envelope contributes to the excess-privilege penalty.Authority below the task requirement is set to zero separately for each dimension.
  • A. Task Relative Authority: Supported actions run in non-root containers or resettable MCP services, while post-execution audits inspect diffs, telemetry, service records, sensitive-path access, and exact state changes.These audits measure real effects rather than relying only on static action analysis.
  • A. Task Relative Authority: Verifiers check exact answers, hidden tests, required files, targeted results, MCP state, evidence paths, required writes, and rejection of extra writes.Proposal-only tasks penalize environment changes, escalation tasks require evidenced intervention reasons, and evidence is terminal-gated.

C. Modular Framework Use

The framework separates brokers, task schemas, post-action verifiers, and excess-privilege calculation to support tasks with different behaviors and authority needs. Its excess-privilege calculations and multi-step verification broker can also be incorporated into reward functions beyond Dr.GRPO.

  • Modular Framework Use: The framework separates brokers, task schemas, post-action verifiers, and excess-privilege calculation for tasks with different behaviors and needs.This modularity supports task-specific authority assessment.
  • Modular Framework Use: In a bug-report patch proposal, reading bug.txt is sufficient, whereas writing is classified as excessive authority.Because the correct run executes no mutative action, pre-action brokers require evidence terms.
  • Modular Framework Use: The framework’s excess-privilege calculations and multi-step verification broker can be incorporated into reward functions and algorithms beyond Dr.GRPO reinforcement learning.The framework is not restricted to a single reinforcement-learning optimization method.
  • Modular Framework Use: A blocked command causes no external damage but is still recorded as a reportable excess-authority event when the policy requested unjustified authority.The metric distinguishes attempted actions from effects allowed by the environment.

B. Brokered Execution and Automatic Verification · D. Reward and Training

The framework brokers proposed actions through pre-execution auditing and execution-result feedback, while training optimizes a scalar reward that combines task success with least-privilege considerations. The reward deliberately favors lower-authority actions, and Qwen3.5-4B is trained with a specified LoRA and Dr. GRPO configuration.

  • B. Brokered Execution and Automatic Verification: Every trajectory begins with host-broker analysis of the proposed action before execution.Pre-execution auditing considers command family, flags, paths, redirection, composition, and tool identity.
  • D. Reward and Training: The scalar reward is used for learning optimization.The supplied passage introduces the scalar reward definition without providing its equation.
  • D. Reward and Training: The penalty term P combines weighted trajectory excess, secret-access excess penalties, label confidence, and a capped stepwise excess term, while U penalizes action count.These terms incorporate both authority excess and action economy into the optimization objective.
  • B. Brokered Execution and Automatic Verification: The reinforcement-learning loop has the policy select actions, the broker pre-audit and execute them through terminal or MCP services, then calculate rewards from results.The broker parses actions, sends them to services, receives results, and calculates rewards for training updates.
  • D. Reward and Training: The reward includes correct-escalation credit, blocked-action severity, malformed or unsupported-action penalties, and forbidden-read penalties alongside task-objective terms S and E.The non-objective terms are not potential-based, so policy invariance is not guaranteed; this intentionally favors lower-authority actions.
  • D. Reward and Training: Qwen3.5-4B was trained with rank 32 LoRA, alpha 64, bfloat16, and direct Dr. GRPO for one 1,500-step epoch.Each row sampled eight trajectories with 4,096-token completion budgets and a 20-tool-call limit; training used clipping 0.2, batch size one, gradient accumulation eight, no KL term, and no supervised fine-tuning.

E. Tasks and Evaluation

The evaluation uses a 2,000-task catalog split into training, within-family validation, and excluded-family validation tasks. Internal evaluation spans all 500 held-out tasks across 2,896 episodes, with additional routine checkpoint and external deterministic evaluations.

  • Task catalog: 2,000 tasks comprise 1,500 training tasks, 300 within-validation variants, and 200 excluded-family validation tasks.Within-validation tasks primarily test training gains and guard against explicit reward hacking.
  • Task catalog: Each task includes a reference oracle, sufficient-authority envelope, evidence requirements, deterministic verifier, and negative test examples.Tasks are synthetically generated and validated through predefined schemas and task families.
  • Internal evaluation: 2,896 episodes evaluate all 500 held-out tasks, with four generations for 276 ordinary tasks and eight for 224 safety-heavy tasks.A smaller 206-task subset is used for routine checkpoint evaluations and ablations.
  • Validation splits: The within-validation split changes vocabulary, content, answer fields, and templates, while excluded-family tasks introduce new workflows and MCP messaging schemas.Both remain structured around the same broker, sandbox, and verifier conventions.

IV. EXPERIMENTAL RESULTS AND DISCUSSION · A. Internal Results

Internal evaluations selected Seed 1 as the most stable seed and found strong safe-success performance, including on whole-family-heldout and unseen-MCP tasks. Gains emerged early in training, while later training produced smaller targeted improvements and exposed a need for greater task variety and difficulty.

  • A. Internal Results: Seed 1 was selected as the most stable seed after safe success of 85.98%, 97.63%, and 86.29% for seeds 0, 1, and 2, respectively.Selection used the routine 206-task evaluation set before complete 500-task and external evaluations.
  • A. Internal Results: 1,020/1,020 safe episodes were recorded by Seed 1 on the 200-task whole-family-heldout partition, compared with 689/1,020 for the base policy.The result covered task schemas and families absent from training.
  • A. Internal Results: 440/440 safe episodes were recorded by Seed 1 on the unseen-MCP family, compared with 220/440 for the base policy.Seed 1 also made no exact-lure or forbidden-read attempts in the reported comparison.
  • A. Internal Results: 97.63% safe success was reached at checkpoint 1,500 on the 206-task routine check catalog, versus 96.91% at checkpoint 500 and 97.57% at checkpoint 1,000.The checkpoints show that internal gains appeared early in the training suite.
  • A. Internal Results: 581/593 of the total improvements, or 98%, were present at checkpoint 500, indicating that later training primarily fixed select families in single-digit numbers.This quantifies the concentration of improvement in early training.
  • A. Internal Results: The internal results suggest limited task variety and a need for more difficult or ambiguous tasks.The discussion also characterizes the framework as achieving saturation with fewer than 1,500 tasks than might initially appear necessary.

B. Prompt Ablation · C. External Evaluation by Independent Benchmarks

Prompt ablation shows that seed 1 preserves safe success across reduced prompts, while the base policy declines more substantially. Independent benchmarks show retained and improved tool-selection and over-privilege performance outside the training tasks.

  • B. Prompt Ablation: Training used an extensive prompt describing executable-environment details and least-privilege conduct, partly to avoid cold-starting reinforcement learning through simple fine-tuning.The passage notes concern that prompt-modified training data can create dependency on templates rather than generalization.
  • B. Prompt Ablation: Seed 1 safe success changes by only 0.24 percentage points across prompt conditions, compared with 3.70 points for the base policy.With the full prompt, safe success is 97.63% for seed 1 and 61.65% for base; under the short prompt, rates are 97.39% and 57.95%.
  • B. Prompt Ablation: Removing least-privilege wording leaves seed 1 safe success at 97.63%, while base safe success changes from 61.65% to 60.92%.The short one-line prompt lowers base safe success to 57.95%, while seed 1 remains at 97.39%.
  • B. Prompt Ablation: Successful excess-authority error events rise from 0.73% to 0.97% without security wording and reach 1.46% under a one-line prompt.The one-line condition also removes interface instructions and specifications, so the base decline is not attributable solely to excess-authority errors.
  • C. External Evaluation by Independent Benchmarks: MetaTool evaluates general tool-selection ability, while FORTIS evaluates over-privileged action choice on functionally out-of-distribution tasks.The benchmarks were independent and were not used to select the training checkpoint.
  • C. External Evaluation by Independent Benchmarks: 836 of 1,000 MetaTool items are answered correctly by seed 1, compared with 819 for base, with the improvement statistically significant at p = 4.55 × 10−4.The result indicates no degradation in general tool-selection ability under the training framework.
  • C. External Evaluation by Independent Benchmarks: FORTIS Task 1 improves exact minimum skill by 2% and reduces over-privilege by 1.67% for the trained policy, with total safe-rate improvement significant at p = 0.026.For FORTIS Task 2, only 1,250/1,543 items produced parseable outputs for both policies, limiting comparison to shared parseable items.

D. Prompt and Policy Effects on ToolPrivBench

ToolPrivBench evaluates escalation from standard to higher-authority substitutable tools after transient failures, unlike environments where higher-authority actions may be required. Privilege-aware, task-specifying prompts reduce over-privilege, especially for the trained seed policy.

  • Benchmark setup: ToolPrivBench tests escalation between substitutable standard and higher-authority tools after transient failures.This differs from the internal environment, where actions may be complementary and higher-authority actions can be required.
  • Default prompting: 45.2% for base and 45.0% for seed 1 are the default-prompt over-privilege rates, with no statistically different paired-test performance.
  • Privilege-aware prompting: 41.2% for base and 37.9% for seed 1 are the over-privilege rates under privilege-aware, task-specifying prompts.The prompt reduces over-privilege by 4.0 points for base and 7.2 points for seed 1.
  • Privilege-aware prompting: 7.4 points below the default base condition is the prompted seed-1 condition, suggesting partially unlockable generalizable and learned least-privilege awareness and executive capability.

E. Continuation Study Results · F. Interpretation and Discussion

A 400-task corrective continuation generalized least-privilege behavior to new task scenarios while preserving prior capabilities, improving held-out safe success and reducing ToolPrivBench over-privilege. The discussion attributes these gains to learned restraint that complements, rather than replaces, prompting and conventional privilege controls.

  • E. Continuation Study Results: The continuation combined 200 ToolPrivBench-styled corrective tasks with 200 rehearsal tasks from the original training set.The corrective tasks targeted failure, bounded retries, convenience traps, escalationnecessary tasks, and equal-authority alternatives while rehearsal was used to prevent catastrophic forgetting.
  • E. Continuation Study Results: 90.50% safe success was reached on a held-out 50-task set, up from 67.75% for the parent seed-1 policy.On the internal 500-task validation set, safe success changed only at 8 improved tasks.
  • E. Continuation Study Results: 6.99 percentage points was the decrease in ToolPrivBench over-privilege, falling from 45.04% to 38.05%.The reduction was statistically significant (p = 3.7×10−5), while benchmark success rose from 514 tasks to 533 tasks.
  • E. Continuation Study Results: 64/64 convenience-trap tasks and 142/152 transient-retry tasks were solved safely after continuation, compared with 8/64 and 121/152 previously.These targeted improvements were presented as evidence that continuation fixed its intended behaviors and generalized beyond the initial training scenarios.
  • F. Interpretation and Discussion: 99.27% of validation-set episodes were completed by seed 1 while excess-authority events fell from 132 to 23.Because both policies received the same least-privilege rules, prompt, and environment, the 34.12-point safe-success difference indicates a gap in applying and understanding those rules.
  • F. Interpretation and Discussion: Safe success was emphasized because it requires completion, evidence, exact-state verifiability, and no excess-authority event.The discussion rejects optimizing over-privilege alone because reducing actions without accounting for success can degrade capability.
  • F. Interpretation and Discussion: External tests found increased MetaTool accuracy, fewer over-privileged choices on comparable FORTIS items, and stronger response to ToolPrivBench privilege-aware instructions.Default-prompt ToolPrivBench results were statistically indistinguishable between policies.
  • F. Interpretation and Discussion: The learned policy still requires deployment-specific prompting and ordinary system controls, including privilege gates that separate sensitive operations.Prompting helps specify how least-privilege knowledge should apply to unfamiliar interfaces and clarify expected actions, roles, and authority.

V. LIMITATIONS AND FUTURE WORK

The study’s limitations include synthetic task construction, judgment-dependent authority specifications, limited model and adapter coverage, insufficient task variety, and continuation-study selection bias. Future work should broaden task diversity and model coverage, investigate prompt-specific discrepancies and reward choices, and improve training stability with cold-start SFT.

  • Study limitations: Synthetic task families and judgment-based authority dimensions limit how conclusively the results establish real-world performance.Whole-family holdouts and template-group checks reduce construction and cross-family dependence, but do not establish performance on un…; authority dimensions, weights, and sufficient envelopes may be imperfect judgments.
  • Study limitations: The study evaluates only one 4B model and one adapter family, limiting evidence across model families and scales.Prior research is cited as suggesting representation-level similarities may support transfer to other large language model families and scales.
  • Study limitations: 98% of internal safe-success capability gain occurs by Step 500, while limited ToolPrivBench improvement and prompt-neutral indistinguishability suggest insufficient task variety.The trained policy also regresses on some failure-escalation behavior under ToolPrivBench’s prompt-neutral prompting.
  • Study limitations: The continuation study began from selected seed 1 rather than the base model and was motivated post hoc, weakening its evidence for unbiased generalization.Future work should mix the separate continuation tasks from the start of training from the base model.
  • Future work: Two seeds showed instability with malformed arguments for unseen MCP families, motivating cold-start SFT and further reward-function ablations.The reward weights were selected manually, significant value alterations were not tested, and future work should assess whether substantially better combinations exist.

VI. CONCLUSION

The conclusion finds that minimally sufficient least privilege can be learned for executable agents and multi-tool actions without degrading capability. A least-privilege-aware post-training framework substantially improves safe success while reducing successful excess-authority events.

  • 98.48% safe success versus 64.36% on the complete 500-task comparison after least-privilege-aware post-training.The framework achieved this improvement without degrading capability.
  • 0.79% successful excess-authority events versus 4.56% under the framework.The result reflects reduced excess authority alongside improved task completion.
  • The framework combines a six-dimensional risk vector, pre/post-action audits, sufficient-authority envelopes, evidence gates, and exact-state verifiers.These components support learning minimally sufficient authority across executable environments and multi-tool actions.
Loading 2608.18351v1…