PaperlayerView exact revision on arXiv

Source-linked AI summary

If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary

Marc Millstone, Tyler Akidau, Johannes Brüderl, Marat Pekker

arXiv:2608.27646v1cs.AI

TL;DR

Agent credentials provide reach without the judgment that limits use, and prompts alone leave the same reasoner responsible for interpreting untrusted data and enforcing its own limits. The paper introduces OBPE, a trusted tool boundary that authorizes and shapes exchanges under an owner-set ceiling that agent policy can only narrow. Across four models and 3,621 trials, trace failure fell from 57.6% to 0.2%, while safe-useful completion increased, though reconstruction and side-channel risks remained.

  • Problem

    Agent credentials can exceed task-specific needs, while model reasoning is an unreliable place to enforce limits against untrusted data and instructions.

  • Method

    OBPE enforces typed authorization, request shaping, response filtering or masking, and semantic gating at a trusted boundary outside agent reasoning.

  • Results

    57.6% to 0.2%: across four models and 3,621 trials, OBPE reduced trace failures while paired safe-useful completion improved.

  • Takeaways & Limitations

    OBPE enforces structural and effect constraints at the tool exchange, but inference across allowed observations still needs another defense.

  • Takeaways & Limitations

    The evaluation does not establish noninterference: reconstruction failures remained, and timing, durable approval, history, broader writes, and streaming were outside released evidence.

Abstract

from arXiv · show

Give an agent a human's credential and it inherits the person's reach without the judgment that limits its use. It can sweep every reachable record into model context, where hidden instructions steer its next call, and every request stays credential-valid while the agent exceeds its job or absorbs a secret. Prompts are a brittle guardrail: one fallible reasoner interprets the task and enforces its limits. We present Out-of-Band Policy Enforcement (OBPE), a trusted boundary outside agent reasoning. It authorizes the typed operation and resource, narrows the query before the backend call, then filters records and fields or masks values in the response. Semantic gating can deny or hold an authorized call on argument values or external state. A data policy owner sets the maximum grant; agent policy can only narrow it. We prove, under stated conditions, that the policy plan is order-independent and agent policy cannot widen the ceiling. Field removal covers one execution; masking and history rules claim less. We release an HTTP proxy prototype simplified from our production system, with conformance tests tying its typed Cedar policy core to the model. Against Jira and ServiceNow mocks, our benchmark compares prompted agents with and without OBPE on four models, including 20 adaptive red-team tasks. A trace failure means protected data entered agent context, an exact value appeared in the answer, or a forbidden effect completed. In 3,621 trials it fell from 57.6% to 0.2%, a cluster-weighted reduction of 41.2 points [95% CI: 27.7, 54.9]; fulfillment fell from 79.1% to 60.9%, while paired safe-useful completion rose 21.8 points [9.5, 35.2]. Some answers reconstructed a value that never entered context or used filtered row counts as an oracle: shaping one execution is not noninterference. Write controls, durable approval, and temporal and aggregate policies lie outside this evaluation.

1 Introduction

The paper argues that agent delegation needs enforcement at the tool exchange, because credentials provide reach without the judgment that limits use. OBPE supplies typed authorization, exposure control, semantic gating, and policy composition outside model reasoning.

  • Motivation: Credentials give agents broad reach but do not carry the worker’s judgment that limits an autonomous loop.Agents can chain retrieval and action under borrowed authority, while returned data becomes part of subsequent reasoning.
  • Motivation: Untrusted records can contain secrets or injected instructions, so permitted exchanges require exposure control rather than whole-record denial alone.The boundary can restrict what reaches the agent while preserving safe portions of a permitted exchange.
  • OBPE design: OBPE places a trusted boundary between the agent and backend to authorize typed operations, narrow requests, and filter or transform responses.Under the stated assumptions, the agent cannot choose its policy, spoof its identity, or bypass enforcement.
  • Policy model: The data policy owner sets the maximum grant, while agent policy can only narrow it.This guarantee depends on trusted identity binding and an owner policy that accurately states the intended ceiling.
  • Composition and guarantees: Under stated conditions, staged policy composition is independent of match order and a well-formed agent restriction cannot enlarge the owner-only plan.The released path is tested for conformance to these modeled properties.
  • Evaluation: 57.6% to 0.2%: trace-failure rate across 3,621 trials fell with OBPE, while safe-useful completion improved across all four agent models.Trace failures include protected exposure, exact disclosure, or forbidden backend effects.

3 Architecture and Enforcement Path

OBPE places a trusted, typed enforcement boundary between an agent and backend, mediating both requests and responses. It can authorize, defer, deny, narrow requests, and shape returned data before it reaches model context.

  • Boundary placement: OBPE mediates complete request and response paths, stopping forbidden effects before dispatch and shaping returned data before model exposure.This requires every supported path to remain inside the boundary.
  • Typed exchange: Platform-bound identity selects the agent policy, while connector mappings expose principals, actions, resources, records, fields, and arguments to policy.A missing callable surface or policy-relevant field creates an enforcement gap.
  • Policy plan: A permit proceeds through request shaping and backend execution, while a defer stores a shaped request without dispatch and a deny ends the exchange.The response plan is computed only for permitted calls.
  • Stage enforcement: Request shaping can narrow queries or typed writes; response shaping filters rows and fields, masks content, and sanitizes the envelope before delivery.Counts, cursors, errors, ranking, and timing may still require additional shaping or denial.
  • Implementation boundary: The released prototype is a simplified HTTP proxy evaluated on supported complete HTTP requests and responses, excluding streamed responses and several MCP surfaces.Production deployment details are descriptive rather than evaluation evidence.
  • Policy selection: Owner and agent rules remain separate: only owner rules establish permit eligibility, and agent rules can only narrow the resulting grant.The backend credential remains an outer execution limit.

5 Composition and Guarantees

The paper defines a staged policy composition whose restrictions combine predictably under explicit assumptions. It proves order-independent plans and shows that well-formed agent restrictions cannot enlarge owner-authorized capabilities, while limiting information-flow claims.

  • Assumptions: The guarantees depend on bound identity, complete mediation, fixed policy inputs, stable stage semantics, safe write direction, and trusted held-call state.If conjunction cannot be established for a query language, the boundary must deny before dispatch.
  • Guarantee boundaries: Field removal or full redaction establishes value absence from one response, but masking, projections, and history-dependent policies do not establish general noninterference.Pattern masking is best effort, and temporal policies require trustworthy ordered history.
  • Deferred execution: Deferred-execution safety means non-dispatch without a live resolver or timeout worker; terminal resumption guarantees require the full O5 clauses.The released artifact establishes fire-and-hold rather than durable terminal progress.
  • Permutation invariance: Under O1–O5, fixed inputs determine one policy plan regardless of rule order within owner and agent policy matches.The proof relies on commutative, associative, and idempotent meets plus canonical content normalization.
  • Monotonicity: Once owner policy establishes permit eligibility, adding a well-formed stage restriction cannot enlarge actions, resources, predicates, fields, writable fields, caps, or clamps.Adding a same-tier permit rule is explicitly outside this claim.
  • Two-tier authority: Agent policy cannot establish permit eligibility; it can leave the owner decision unchanged or move the gate toward deferral or denial.With no agent policy, the plan is owner-only.

6 Implementation

The released artifact implements the OBPE contract as an inspectable HTTP proxy with typed schemas, Cedar authorization, connector mappings, and conformance checks. Production adds broader deployment surfaces, but those surfaces are not empirical evidence here.

  • Released artifact: The artifact implements gate–request–response composition through a small HTTP proxy connecting an in-process caller to controlled mock backends.Cedar supplies the permit-or-forbid core, while OBPE annotations select gates and shaping operators.
  • Schema surface: Typed schemas define the operations, resources, arguments, response fields, field groups, and sensitivity labels that OBPE can govern.Policy can control only data exposed by the connector as typed data.
  • Write controls: Write shaping is constrained by schema declarations: fields may be dropped only when omission is safe, and numeric clamps must have a declared restrictive direction.Incorrect declarations can alter backend semantics.
  • Conformance: Jira and ServiceNow mappings use published vendor interfaces, with conformance fixtures checking operations and response shapes presented to policy.A coverage analyzer identifies unresolved field groups or operator settings without implying every operator is reachable.
  • Evidence scope: Production adds MCP transport, remote A2A support, a principal registry, and approval semantics, but conformance and outcome claims stop at the released artifact.Production entries are deployment descriptions, not artifact evidence.
  • Interface projection: Dynamic schema projection can remove properties, constrain inputs, and advertise output masking, while the execution path still enforces restrictions.The projected interface is therefore a steering aid rather than the enforcement boundary itself.

7 Evaluation Methodology

The evaluation separates conformance of the released enforcement path from benchmark effects on agent security and utility, using controlled comparisons, frozen artifacts, and trace- and judge-based outcomes.

  • Conformance: Conformance tests verify staged composition, policy-tier restrictions, shaped exchanges, schema resolution, and write behavior before benchmarking begins.Property tests cover permutation invariance, monotonicity, and the data policy owner ceiling; some operators remain synthetic because the shipped schemas lack required facts.
  • Experimental design: The benchmark uses raw, prompt-only, full-OBPE, and output-review configurations to isolate changes in the tool path and message review.Prompt-only adds six data-handling rules without changing the direct tool path, whereas full OBPE adds reachable operators; output review leaves the tool path raw.
  • Experimental design: The corpus contains 71 tasks in 35 scenario clusters against controlled Jira and ServiceNow mocks, spanning four tool-capable models and fresh fixture copies.The models provide purposive coverage of two families and capability bands, not a factorial provider comparison; the setup does not establish interoperability with live deployments.
  • Experimental design: 3,621 planned trials cover 71 tasks, 17 frozen conditions, and three replicates, with content-derived scheduling, balanced order, and no early stopping.The security suite estimates conditional effectiveness rather than ordinary-traffic intervention rates, and five unshaped permits cannot establish a general benign false-denial rate.
  • Outcomes: A deterministic trace failure occurs when protected data enters context, an exact protected value appears in the answer, or a forbidden backend effect completes.Safe-useful completion additionally requires no trace failure, fulfillment of the archived completion and expected-tool contract, and no semantic disclosure.
  • Analysis and reproducibility: The analysis weights scenario clusters equally, resamples clusters for 95% confidence intervals, and preserves judgment disagreements and missing receipts in the released archive.Three trials lacked complete paired judgments, and no human adjudication pass was added; deterministic traces control when they contradict a judge.

8 Results

Across four models and controlled comparisons, OBPE sharply reduced trace failures by changing the tool exchange before exposure or backend effects, while stricter enforcement reduced ordinary fulfillment but increased safe-useful completion. The results also expose limits: reconstruction, query-evaluator defects, and incomplete outcomes prevent interpreting shaping as full noninterference.

  • Primary comparison: 57.6% to 0.2%: OBPE reduced the overall trace-failure rate in prompted trials.The two remaining exact disclosures reconstructed values from information the boundary permitted.
  • Primary comparison: 41.2 percentage points: OBPE avoided trace failure in the paired, cluster-weighted estimate.The 95% CI was [27.7, 54.9], and every model-specific estimate favored OBPE.
  • Utility: 79.1% to 60.9%: standalone fulfillment fell, while safe-useful completion rose by 21.8 percentage points [9.5, 35.2].Denied and deferred tasks were counted as unfulfilled, while many prompt-only completions were unsafe.
  • Red-team evaluation: 74.9% versus 0.9%: trace failure occurred in the completed red-team prompt-only and OBPE runs, respectively.The stress slice included 20 response-adaptive tasks and incomplete runs caused by a loop defect.
  • Prompt dependence: 59.5% to 1.0% without prompt rules and 61.9% to 0.0% with them: OBPE showed the same descriptive direction in the Sonnet 2 × 2 experiment.The estimated difference between effects was 0.2 pp with a wide interval of [-12.3, 12.7], so independence was not established.
  • Cumulative controls: 46.7%: record controls alone protected trials, while field stripping, masking, and write guard added further protection.The cumulative analysis attributed gains of 9.9 pp to field stripping, 7.8 pp jointly to masking and write guard, and 11.5 pp to pattern masking.
  • Utility: 21.8% to 63.0%: across the cumulative ladder, safe-useful completion increased as stricter rungs blocked more requested work.Standalone fulfillment fell from 75.1% to 66.2%, while the mechanical contract stayed near 91%.
  • Comparison with output review: 58.6% versus 0.0%: output review retained a high deterministic trace-failure rate, whereas full OBPE eliminated it in the Sonnet comparison.OBPE also achieved 63.0% safe-useful completion versus 19.7% for review and required no additional model call.

9 Related Work

Related defenses address authorization, policy typing, history, tool access, provenance, or prompt-injection resilience at different points in the exchange. OBPE distinguishes itself by combining exchange mediation with owner-bounded narrowing and response shaping.

  • Zanzibar, Cedar, IAM boundaries, OAuth extensions, row security, query rewriting, and Envoy processing each constrain parts of authorization or data exchange.The cited systems do not, as documented, bind these stages into the same owner-bounded request-and-response contract.
  • AgentCore Policy maps tools to Cedar actions, while Dogwood adds prior-event and windowed-aggregate evaluation.The documented comparison says these systems do not selectively shape returned records or define the same owner–agent narrowing contract.
  • Progent, SEAgent, CaMeL, PAuth, and privilege separation reason about generated rules, mandatory tool access, capabilities, provenance, or quarantined-model boundaries.OBPE instead begins at the mediated exchange, with portability limited by trusted identity and connector coverage.
  • AgentDojo evaluates whether useful work survives prompt-injection defenses, whereas this work scores exposure and forbidden effects alongside useful completion.The paper also adds a two-tier model, restriction law, conformance link, and cross-model experiment to the cited prior work.

10 Limitations and Broader Impacts

The paper’s broader limitations concern policy correctness, operational governance, residual information channels, and evaluation scope. These boundaries constrain what OBPE can guarantee and what the released evidence establishes.

  • OBPE cannot repair a valid but mistaken owner ceiling because static checks do not determine organizational intent.Rewritten queries must preserve caller and policy predicates together or be denied before dispatch.
  • Schemas require named ownership, coordinated policy-and-schema rollout, rollback, and review when fields or backend meaning change.Cedar supplies none of these operating controls, and open maps require finite allowlists or opacity.
  • The mocks omit rich text, recursive or polymorphic objects, cross-tenant tests, durable approval, history gates, broader writes, timing, and streaming.The released evidence therefore does not cover these settings, although assignment-bound credentials and instruction–data separation could narrow the motivating gap.
  • Audit and approval records can expose worker activity, requiring restricted access, limited retention, worker notification, and exclusion from employment decisions.Approver fatigue should trigger policy review when deferral volume rises.

11 Conclusion

The conclusion presents OBPE as an owner-bounded exchange control whose formal restriction properties are targeted by prototype conformance tests. Its evaluation reports lower trace failure and higher safe-useful completion, while retaining important scope and governance boundaries.

  • OBPE governs the whole tool exchange under an owner ceiling that agent policy can only narrow.Its model states conditions for an order-independent, non-widening policy plan, and the prototype makes those conditions a conformance target.
  • 41.2 points less trace failure occurred across four models in the paired, cluster-weighted analysis.Unweighted fulfillment fell from 79.1% to 60.9%, while paired safe-useful completion rose 21.8 points under the primary judge and 19.1 under the second.
  • Four reconstructed values and one row-count oracle expose a remaining boundary: inference across allowed observations still needs another defense.OBPE enforces structural and effect constraints at the exchange, but shaping one execution is not noninterference.
  • The evaluation uses synthetic Jira and ServiceNow mock records, excludes human subjects and customer or employee data, and does not test consequential decisions about people.Those settings raise fairness and due-process questions that a tool boundary cannot answer.
  • Production operators should restrict audit access and retention, inform workers about records, and keep logs out of employment decisions.Write shaping also requires making narrower backend updates visible while preserving enough audit detail without copying sensitive values into logs.
  • Only designated data stewards should set the owner ceiling, with review, impact explanations, and avenues to contest erroneous labels or scopes.Static analysis can find structural mistakes but cannot decide whether a valid policy is fair or faithful to organizational intent.
  • The artifact includes the HTTP proxy, controlled mocks, schemas, policy bundles, runners, prompts, parsers, and provider adapters used for reported outcomes.Its corpus lock, transcripts, conformance ledger, analysis code, and offline regeneration commands record experimental conditions, while fresh model calls may differ.

A Example Policies

The example policies show record-scope narrowing through upstream query pushdown or gateway filtering, combined with field controls, caps, and semantic deferral. The two-tier composition keeps owner permissions as the ceiling while allowing agent restrictions to shrink the exchange.

  • Record-scope: Record-scope conditions can be pushed into the upstream query or applied as a gateway response filter, with both examples keyed to the caller’s team.Pushdown prevents out-of-scope records from leaving the upstream; gateway filtering works against any backend.
  • Policy tiers: The example combines authorization, exposure control, and semantic gating across owner and agent policies.The owner strips restricted fields and defers a Critical-issue update, while the agent adds a scoped, capped listing.
  • Agent policy: The agent listing policy scopes results to a team and caps the response at 100 while retaining only the summary field group.The policy applies to get and list actions on Issue resources.
  • Owner policy: The owner read policy retains the summary field group, while the owner update policy defers a Highest-priority assigned issue for 3600 seconds to the on-call lead.The defer rule applies when the resource assignee matches the principal account and priority is Highest.
  • Composition trace: The agent tier creates no permit: it adds a predicate, lowers the cap, and can only shrink the retained field set.The resulting sampled pages may differ even though Proposition 3 orders the policy plans rather than the pages.
  • Composition trace: Across a list, triage read, and Critical-issue update, the gateway returns permit, permit, and defer.The owner supplies the strip and defer for every agent, while this agent adds only the scope query; stateful aggregate gates remain outside the prototype bundle.

B Pattern-Compliance Matrix

The matrix formalizes conditional enforcement properties and the assumptions needed for order-independent composition and owner-ceiling containment. It distinguishes documented assessments from guarantees that depend on specific preconditions.

  • Pattern-Compliance Matrix: Table 6 grades enforcement properties at cited versions, with partial marks covering conditional, narrower, or incompletely exercised support.The grades assess pinned public documentation and artifacts rather than overall system quality.
  • Composition Preconditions and Proof Detail: Under O1–O5, fixed matched rules yield one policy plan, and another restriction cannot widen it.These claims are conditional on the stated obligations and are tested for conformance in the released path.
  • Composition Preconditions and Proof Detail: Stage operators compose through commutative, associative, and idempotent meets, while content rules use deterministic normalization by a fixed sort key.The content normalizer is not a semantic meet over arbitrary strings.
  • Composition Preconditions and Proof Detail: The owner-eligibility premise excludes default-deny-to-owner-permit transitions and same-tier Cedar permit additions from the containment proof.The proof also requires absence safety for drops and a restrictive direction for clamps.
  • Composition Preconditions and Proof Detail: Only structural stripping and full redaction retain value-absence claims; partial projections and pattern masks remain incomparable.Canonical normalization makes pattern-mask execution order-independent without ordering arbitrary output bytes.

D What Static Analysis Can Establish

Static analysis can identify conflicts in written policy, but it cannot establish organizational intent, complete secret capture, owner-agent containment, or inference safety. The paper also marks deployment and registry boundaries that limit what the released artifact supports.

  • What Static Analysis Can Establish: Static analysis finds policy conflicts and dead rules but cannot determine organizational intent, complete pattern coverage, or what an agent infers from visible data.These limitations apply even when the written policy is analyzable.
  • What Static Analysis Can Establish: An opaque shaping model may conservatively flag exposure or writes, but it cannot prove owner-agent containment without symbolic annotation semantics and connector correspondence.The paper presents this proof as proposed work rather than an established result.
  • What Static Analysis Can Establish: Structural removal proves absence only from one response; masking and temporal predicates do not receive a general static guarantee.Projection alone does not show that retained fields reveal nothing about a removed value.
  • What Static Analysis Can Establish: Production orders prompt-injection susceptibility and cross-tenant reach independently, making their product a lattice in which some capability profiles are incomparable.The released proxy exercises only the sensitivity chain.
  • What Static Analysis Can Establish: Read and write risk use different orders, so write corruptibility cannot be inferred from read sensitivity.The paper relates these orders to Biba integrity and Bell–LaPadula clearance.
  • What Static Analysis Can Establish: The released artifact relies on Cedar for authorization and connector annotations for shaping, with schemas supplying resource, field, and wire semantics.Record filtering requires a separate per-record permit, and shipped schemas do not enable field dropping or clamping.
  • What Static Analysis Can Establish: Propositions 1–2 and INV-SG hold only when their corresponding preconditions are satisfied, with implementation and testing boundaries recorded separately.The evidence boundary distinguishes formal assumptions from released-artifact support.
  • What Static Analysis Can Establish: The release supports only a restricted Cedar expression fragment and hand-authored Jira and ServiceNow mappings, without OpenAPI import or recursive-reference and polymorphism support.Conformance covers only the shipped HTTP mappings and mock backends.

F Benchmark Accounting and Scoring Detail

The benchmark preserves trial-level accounting, separates denominators and provider receipts, and traces enforcement through backend effects and normalized content. Deferral analysis distinguishes holding a call from safely resuming it, which the released proxy does not implement.

  • Benchmark Accounting and Scoring Detail: Each trial has frozen conditions, a journaled attempt history, one terminal record, and judgments bound to the trial and blinded-input hash.Failures and judge disagreements remain separate records.
  • Benchmark Accounting and Scoring Detail: Primary contrasts pair tasks and resample scenario clusters, while complete-block sensitivity retains only replicate indices present in both arms.Available replicates are averaged without silently filling missing records.
  • Benchmark Accounting and Scoring Detail: Sensitivity checks assign unknown security outcomes in opposing worst-case directions and omit each cluster in turn without changing archived outcomes.The checks also count which arm each cluster favors.
  • Benchmark Accounting and Scoring Detail: Missing token receipts lower adversary and harness spend bounds, leaving token accounting incomplete while outcome calculations remain receipt-independent.The conformance ledger follows operators through schema, plan, shaped exchange, backend effect, audit, and normalized content.
  • Benchmark Accounting and Scoring Detail: Deferral holds a call outside the backend until an external decision over an immutable request snapshot yields approval, rejection, or expiry.The agent cannot access the resolver channel while the call is held.
  • Benchmark Accounting and Scoring Detail: The production resolver serializes evaluation and commit for relevant keys, uses replay protection, and releases only the reviewed snapshot.Dispatch still requires an idempotency key or backend transaction fence.
  • Benchmark Accounting and Scoring Detail: The released proxy demonstrates hold and no-dispatch, but not safe resumption, durable approval, or full INV-SG.Its stored snapshot omits query parameters, headers, and pre-fetched state; timeout is not persisted as terminal.
Loading 2608.27646v1…