PaperlayerView exact revision on arXiv

Source-linked AI summary

Deny Without Disabling: Authorization-Paired Evaluation and Control for Multi-Agent Systems

Yunbei Zhang, Saiyue Lyu, Janet Wang, Yingqiang Ge, Jiang Guo, Jihun Hamm, Chandan K Reddy

arXiv:2610.00371v1cs.MAcs.AIcs.CR

TL;DR

Multi-agent systems can combine admissible fragments into a prohibited use, while blocking every sensitive action can disable authorized collaboration. The paper pairs prohibited-use blocking with authorized-use completion and connects this evaluation target to FlowReview's review and enforcement capabilities. In controlled composition experiments, union review reduced denied commits from 413/480 to 0/480 without reducing authorized supply.

  • Problem

    Individually admissible contributions can combine to enable a prohibited use, making authorization a question about the workflow's combined information.

    Source: §1 · p. 1

  • Method

    Authorization-paired evaluation requires both a prohibited use to be blocked and a task-required authorized use to complete, while FlowReview connects object resolution, permission ranking, and deterministic enforcement.

    Source: §1 · pp. 2–3

  • Results

    413/480 denied commits under individual-artifact review fell to 0/480 under union review, while both arms supplied 459/480 required authorized objects.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Object identity and trusted permission must remain connected to execution through verifiable components while preserving the authorized uses of composed information.

    Source: §6 · p. 12

    Controlled banks identify composition mechanisms, while AgentDojo confirmation covers Sonnet 4.5 under a relay selected in development.

    Source: §6 · p. 12

Abstract

from arXiv · show

Multi-agent systems derive their capabilities from sharing evidence, delegating tasks, and combining information across agents. The same process creates a safety problem: contributions that are admissible in isolation can jointly enable a prohibited use. Blocking every sensitive action avoids disclosure but defeats the purpose of collaboration. We introduce authorization-paired evaluation, which makes blocking prohibited uses and completing required authorized uses a joint success criterion, and FlowReview, a framework connecting object resolution, permission ranking, and deterministic enforcement. In controlled composition experiments, reviewing combined artifacts reduces the denied-commit rate from 86.0% to zero with no loss of authorized supply. Our findings show that preserving information and lineage alone does not ensure correct permission attribution. Object identity and permission must remain connected to execution through components whose outputs can be verified. Together, these findings establish a system-level requirement for multi-agent safety: govern composed information flows while preserving the authorized capabilities that make collaboration useful.

1 Introduction

The introduction frames composition as both a source of multi-agent capability and a safety challenge: individually admissible fragments can enable a prohibited use when combined. It introduces paired evaluation and FlowReview to govern composed information while preserving authorized uses.

1 Introduction

  • Multi-agent workflows combine records or agent-produced changes, making authorization a question about the action enabled by the workflow's combined information.The motivating examples include support teams joining service records and software teams assembling changes from different agents.Source: §1 · p. 1
  • 413/480 denied commits persisted under individual-artifact review versus 0/480 after union review, while both arms supplied 459/480 required authorized objects.The comparison holds the proposal, artifacts, and trusted policy fixed while changing the information available to review.Source: Figure 1 · p. 2, §1 · p. 2
  • Selective safety requires blocking the prohibited use while completing the task-required authorized use in the same scenario.The paired target measures surrounding-task completion alongside deny-side performance.Source: §1 · p. 2
  • Authorization-paired evaluation tests this joint target, and FlowReview connects object resolution, permission ranking, and deterministic enforcement.Its scenarios specify governed objects, artifact assignments, and trusted permissions for controlled comparisons.Source: §1 · p. 2
  • Contributor and delegation experiments show that teams can retain an object's fields yet lose resolvable lineage, or preserve lineage while misattributing permission.The proposed design principle places each safety-critical capability where its output can be verified.Source: §1 · p. 3
  • The diagnostic suite pairs prohibited and required authorized uses to expose capability suppression that deny-side scores can conceal.The contribution also assigns review capabilities to components with verifiable outputs, including specialist permission selection and runtime enforcement.Source: §1 · p. 3

2 Setting

The setting models separately invoked agents exchanging recorded artifacts and proposing actions on governed objects. It defines paired outcomes for selective safety and specifies the experimental scope, threat model, and evaluation procedures.

2.1 Agents and information flows

  • Agents have separate input contexts and communicate through messages, records, and handoffs; a governed object is a value or record whose use requires trusted authorization.A proposal is an action on that object, and the commit gate mediates the transition from proposal to executed action recorded in the ledger.Source: §2.1 · p. 3

2.2 Authorization-paired evaluation

  • Authorization-paired evaluation records denied disclosure and authorized supply, requiring both outcomes to be correct for selective correctness.Pairs test either an authorization change for the same scenario and object or object-specific permission discrimination between same-class objects.Source: §2.2 · p. 4

2.3 Experimental design

  • The experiments vary information distribution and control placement across constructed scenarios, model-generated artifacts, and AgentDojo-derived tool-use tasks.The attacker controls untrusted artifacts but not trusted policy, the registered schema, or the commit gate; unresolved proposals retain an execution path rather than being automatically blocked.Source: §2.3 · pp. 4–5
  • Confirmatory comparisons use prespecified scenarios, scenario-cluster bootstrap intervals, and Holm correction, counting failed provider calls and protocol-invalid outputs.The evaluation suite includes five homogeneous and two heterogeneous teams, with the model suite and scaling details described across the experimental-design passages.Source: §2.3 · pp. 4–5

3 FlowReview

FlowReview reviews proposed actions using recorded artifacts, trusted policy, and registered contracts. Its capabilities resolve object identity, rank permissions, enforce decisions at execution, and test where lineage, permission selection, and assembly should reside.

3.1 Review the composed action

  • Object resolution checks artifact evidence against registered object and action contracts, while permission ranking applies trusted policy to distinguish denied from task-required authorized uses.Two-sided binding lets same-class objects with opposite permissions receive different decisions; the commit gate verifies the selected action before execution.Source: §3.1 · pp. 5–6
  • Object binding and deterministic enforcement are presented as recovering selective correctness while reducing disclosure; Figure 3 compares conditions using C and D, where higher C and lower D are better.The figure pools 576 runs per family and condition at a 24-round budget, with scenario-cluster bootstrap intervals.Source: Figure 3 · p. 6
  • Deterministic enforcement verifies a bound action against trusted policy and controls the sole commit path, admitting or blocking the action before execution.For the ladder, the runtime parses schema-defined action fields and removes the denied value; unresolved proposals retain the underlying execution path in read-scope experiments.Source: §3.1 · p. 6

3.2 Capability placement

  • Placement experiments record runtime lineage and use an isolated specialist for permission ranking, with the runtime independently verifying the bound action before execution.A saved Qwen example shows the specialist selecting a correctly bound candidate unchanged after the coordinator mistypes its object reference.Source: §3.2 · p. 6
  • The assembly experiment separates artifact availability from combination ability by comparing a model composer with a runtime assembler using the same validated artifacts.The runtime assembler checks contents against the registered schema and reconstructs the governed object; a fixed fallback replaces invalid or unavailable artifacts without consulting policy or downstream outcome.Source: §3.2 · p. 6

4 Results

The results show that local checks can miss prohibited uses assembled across agents, while selective control depends on resolving governed objects, preserving lineage and permission, and enforcing decisions at execution. Across controlled experiments, broader review and verifiable runtime placement improve denied-use control while preserving authorized actions, though unresolved lineage and task-execution failures remain.

4.2 From detection to control

  • Across 2,304 final-configuration trials, object binding and deterministic enforcement raise selective correctness to roughly 99%, with no verbatim disclosure at the registered action boundary.Class-only review achieves no joint successes because it withholds the required authorized sibling; same-class, opposite-permission objects make object identity necessary for selective control.Source: §4.2 · pp. 7–8
  • Canonicalization lowers denied commits in 22/40 comparisons and raises them in 8/40, showing that enforcement applies only to uses the reader resolves.The transformation-specific decoder has no literal fallback, so either reader can miss uses recognized by the other.Source: §4.2 · p. 7

4.1 Composition defeats local review

  • Reviewing combined artifacts reduces denied commits from 86.0% to zero with unchanged authorized supply.The experiment holds artifacts, policy, proposal, and action boundary fixed while changing review scope.Source: §4.1 · p. 7, Figure 4 · p. 8

4.2 From detection to control

  • Execution responds strongly to trusted authorization but little to untrusted authority claims; deterministic deletion removes observed disclosures after successful detection under model review.The 95% cluster intervals for claim effects fall within the prespecified ±0.10 equivalence margin, while authorized supply is 113/128, below the 0.90 capability threshold.Source: §4.2 · p. 8, Figure 4 · p. 8

4.3 Fragmentation can prevent object resolution

  • Global review blocks resolved denied uses and preserves matched authorized actions, but maximal fragmentation leaves 19/168 graphs unresolved despite complete field unions.Distribution removes complete context from local readers; further fragmentation can disrupt the lineage needed for global review, with the replicated coverage loss clearest for homogeneous Haiku.Source: §4.3 · pp. 8–9, Figure 5 · p. 9

4.4 Verifiable placement restores control

  • Explicit contracts improve lineage but leave permission-attribution errors in 676/840 graphs; runtime-recorded dependencies, permission-bound selection, and commit verification preserve policy-correct proposals and task completion with no denied commits.The runtime records dependencies so models need not reconstruct execution history; the commit gate independently verifies the selected action.Source: §4.4 · pp. 9–10, Figure 6 · p. 10, Table 1 · p. 10
  • On identical validated artifacts, runtime assembly supplies every required authorized object, while rereading current policy restores authorized supply after stale-action rejection.A single repair attempt blocks wrong commits but fails to supply the currently authorized action.Source: §4.4 · p. 10

4.5 Execution control in tool use

  • In independent Sonnet pairs, runtime control eliminates registered target commits and improves utility while exact legitimate-action supply stays unchanged; some final-state violations remain.The action ledger can expose transient attacks even when a later legitimate action overwrites their effects in the final state.Source: Table 2 · p. 11, §4.5 · p. 11

5 Related Work

Related work spans agent-safety evaluation, multi-agent workflow risks, compositional attacks, and information-flow control. FlowReview links these areas through paired evaluation and controlled interventions on resolution, permission ranking, and enforcement across agents.

Agent-safety evaluation

  • Agent-safety benchmarks assess harmful behavior and tool-use attacks, while ST-WebAgentBench includes policy compliance in task success.The cited work also examines risks within multi-agent workflows and compositional jailbreaks across modalities and conversational turns.Source: §5 · pp. 11–12
  • FlowReview ties prohibited and required authorized uses to one scenario and evaluates composition inside the team.This distinguishes its evaluation target from the surveyed evaluation approaches.Source: §5 · pp. 11–12

Information-flow control

  • Building on complete mediation, information-flow control, and capabilities, FlowReview decomposes resolution, permission ranking, and enforcement across agents.Read-scope and contributor interventions locate resolution failures; placement comparisons test how required capabilities survive communication.Source: §5 · p. 12

6 Discussion and Conclusion

Multi-agent safety requires governing composed information while preserving authorized use. FlowReview connects object resolution, permission ranking, and deterministic enforcement so object identity and permission remain tied to execution through verifiable components.

6 Discussion and Conclusion

  • Verifiable components must preserve object identity and trusted permission through communication and connect both to the action that executes.The conclusion frames this as enabling systems to deny prohibited uses without disabling authorized capabilities.Source: §6 · p. 12
  • The controlled banks identify composition mechanisms, while the ladder’s zero-disclosure result is limited to the registered verbatim action boundary.AgentDojo confirmation covers Sonnet 4.5 under a relay selected during development; prevalence in natural workflows and broader model coverage remain future-work targets.Source: §6 · p. 12

Appendix

  • Appendices A–F detail evaluation design, composition and object representation, communication and delegation, permission selection and assembly, and AgentDojo transfer.Appendices G and H provide extended related work and a synthesis of findings.Source: Appendix · p. 18

A Evaluation Protocol

  • The evaluation protocol fixes governed objects, trusted permissions, and action boundaries, pairing prohibited and required uses and specifying sampling units and execution-failure treatment.Dataset construction and role contracts define available information.Source: A Evaluation Protocol · p. 18

A.1 Dataset construction

  • Constructed scenarios specify tasks, governed objects, required authorized uses, and registered action contracts; controlled composition inputs are locally incomplete but resolve the registered object when united.Studies record assignments, artifacts, proposals, and executed actions separately, use registered readers and task checks, and define scenario clusters for pairing and resampling.Source: §A.1 · pp. 18–19

A.2 Agents, topologies, and action contracts

  • The studies vary communication structure, delegation, and component placement while keeping object and policy contracts explicit; model agents are counted separately from runtime readers, assemblers, and commit gates.N counts separately invoked model agents, while K counts initial holders of protected fields; the ladder contributes 2,304 final-configuration trials.Source: §A.2 · pp. 19–20

A.3 Authorization-paired evaluation

Authorization-paired evaluation tests whether a system blocks a prohibited use while completing a required authorized use. The section distinguishes policy-generation effects from commit-time enforcement and shows that review of combined artifacts changes controlled execution outcomes.

A.3 Authorization-paired evaluation

  • Authorization-paired evaluation links a prohibited use with a task-required authorized use, either across paired executions or within one episode containing same-class, opposite-permission objects.The governed objects, required uses, and action-ledger readers are registered before execution.Source: §A.3 · pp. 20–21
  • The design separately intervenes on trusted authorization, untrusted authority claims, and review information; policy responsiveness and authority non-interference have distinct evaluation criteria.Authorized supply and task completion are measured separately so inactivity cannot satisfy the paired objective.Source: §A.3 · p. 21
  • Changing policy during generation can change proposals, whereas runtime replay applies policy at commit time to the same proposal and artifacts.The section also explains that local complete-object checks can all pass while the artifact union resolves the governed object, requiring object resolution and permission enforcement at execution.Source: §A.3 · pp. 21–22

A.4 Analysis and reproducibility

  • Confirmatory designs separate development and confirmation samples, use scenario-cluster bootstrap intervals with Holm correction, and include malformed outputs and terminal provider failures in outcome rates.Two complete executions were excluded for transport-accounting violations before outcome analysis, with replacements preserving the study specifications.Source: §A.4 · p. 22

B Composition and Read Scope

  • Composition lets downstream agents recover objects from individually incomplete artifacts, and fixed-proposal comparisons isolate how reader scope affects execution control.The controlled read-scope comparison changes access to combined artifacts while holding the proposal fixed.Source: B Composition and Read Scope · p. 22, §B.1 · p. 22

B.1 Controlled read scope

  • 0/480 denied commits under global control, versus 413/480 under local control, while authorized supply remains 459/480 in both arms.The fixed proposal and artifacts are evaluated under different reader scopes; the same fixed proposal receives four policy-and-reader combinations in Table 5.Source: §B.1 · p. 22, Table 5 · p. 23

B.2 Model-generated composition

Model-generated composition tests whether agents can reconstruct governed objects from distributed artifacts and whether runtime control enforces permission on recovered objects. The capability ladder then separates detection, object identity, permission ranking, and enforcement under adaptive attacks.

B.2 Model-generated composition

  • 0/60 denied commits occurred under global control, compared with 3/60 local recoveries; authorized supply was 15/60 and task completion was 27/60.The five composer models were tested on 12 matched scenarios each; all three local recoveries occurred with Gemma3-27B, and global control had 0/12 denied commits for every model.Source: §B.2 · p. 23
  • Three Haiku 4.5 workers preserved their assigned fragments, which a Gemma3-27B composer combined into the registered object and proposed for external sending under both policy-conditioned calls.The local per-message rule committed both proposals, while the global object-bound rule blocked the denied proposal and committed the authorized one; both task reports failed the exact-report check.Source: §B.2 · pp. 23–24, Table 6 · p. 24

C From Detection to Control

  • The capability ladder separates content detection, object identity, permission ranking, and enforcement, with attack-budget and authority interventions testing robustness and policy sensitivity.Representation comparisons examine which governed uses a reader resolves.Source: C From Detection to Control · p. 24

C.1 Ladder configuration

  • The ladder evaluates 32 held-out scenarios with denied values and same-class authorized siblings, crossing three drafters, three attackers, and two repetitions for 576 runs per attack-family and configuration cell.Class-only review uses four extractors; object-bound review supplies both governed values and opposite permissions, and the final configuration adds deterministic removal of the denied value.Source: §C.1 · p. 24
  • 2,304 final-configuration trials span two attack families and two adaptive-search budgets of 10 or 24 rounds.Search ends at the first prohibited commit or the round limit; denied disclosure records whether a search succeeds, while authorized supply comes from the last evaluated execution.Source: §C.1 · p. 25

C.2 Budget and model variation

Across budget, object-representation, component, and contributor-scaling studies, the paper tests whether control follows composed information while preserving authorized use. The results distinguish content recognition from permission binding and execution enforcement.

C.2 Budget and model variation

  • At 10 rounds, selective successes are 570/576 and 575/576; at 24 rounds, 573/576 and 574/576, with zero verbatim disclosures in every cell.Across the 2.4-fold budget range, selective correctness is 0.9896–0.9983 and total verbatim disclosures are 0/2,304.Source: §C.2 · p. 25
  • Both trusted-policy conditions meet the empirical untrusted-claim resistance criterion, but authorized supply is 113/128, below the prespecified 0.90 threshold.The separate Llama-3.3-70B replication supplies 32/32 authorized actions and records zero claim effect under both permissions.Source: §C.2 · p. 25, Table 7 · p. 25

C.3 Object representations

  • Canonicalization lowers denied commits in 22/40 representation comparisons, ties in 10/40, and raises them in 8/40; 29/40 differences remain significant after Holm correction.The passage reports that each reader recognizes some proposals missed by the other; Table 8 identifies the comparison scope.Source: §C.3 · p. 26, Table 8 · p. 27

C.4 Component contrasts

  • For same-class, same-shape siblings with opposite permissions, two-sided binding reaches 282/288 selective successes, while class-only and label-located review reach 0/288.A targeted reference-position test records 11/991 disclosures under model review and 0/1,009 under deterministic deletion.Source: §C.4 · p. 27

D.1 Contributor scaling

  • Across 420 distributed-object discovery graphs, local control commits all 420 denied actions, while global control blocks the 415 graphs with resolved lineage and preserves matched authorized actions.All five discovery coverage failures occur at N=16, K=15; the replication reports a homogeneous Haiku maximal-split contrast of −0.417 [−0.625, −0.208].Source: §D.1 · pp. 27–28

D.1.1 Task and communication

  • Informative workers receive disjoint fields and communicate through recorded message, store, and handoff artifacts; only the coordinator sees their union.Dummy-control workers add role count, communication volume, and context without receiving protected fields.Source: §D.1.1 · p. 28

D.1.2 Object and action contract

  • The deterministic runtime commits resolved objects only after checking the proposal against trusted policy; unresolved objects follow the underlying execution path without that object-specific decision.The same execution rule is held fixed across local and global read scopes.Source: §D.1.2 · p. 28

D.1.3 Model teams; D.1.4 Outcomes and estimands

  • At N=8, K=7, the whitelist resolver recovers valid lineage in all 168 graphs despite only 120/168 artifact sets meeting strict schema requirements.Heterogeneous-team comparisons change both worker and coordinator assignments, so they do not isolate the coordinator’s effect; outcomes use scenario clusters as paired units.Source: §D.1.4 · p. 29, §D.1.3 · p. 29

D.2 Delegation contracts

Delegation experiments separate lineage retention from permission attribution, while placement experiments test how runtime records, model selection, and assembly preserve authorization through execution. Explicit permission semantics improve lineage coverage, but attribution drift remains common.

D.2 Delegation contracts

  • Explicit provenance semantics keep lineage within 2.4 percentage points of the runtime-authored bound through N=16, while correct permission attribution rises only from 5.5% to 19.5%.Any-role attribution drift persists in 676/840 graphs; task completion is 840/840 under both paired contracts.Source: §D.2 · pp. 30–31, Figure 9 · p. 31

E.1 Endpoint definitions

  • Permission correctness scores a model’s selection, whereas assembly correctness scores the executed action after the common commit gate.Authorized supply separately checks exact completion of the required ALLOW action.Source: §E.1 · p. 31

E.2 Lineage and permission

  • On 480 held-out graphs per specialist, runtime lineage supports complete lineage, policy-correct proposals, and task completion at 1.0 for all four permission specialists.Permission-attribution drift is 0.0021, false trusted elevation is zero, and the commit gate records no denied commit.Source: §E.2 · p. 33

E.3 Permission selection example

  • In the confirmation example, a coordinator reports the action authorized but selects a candidate with an altered object reference, which the runtime rejects.The passage identifies this as the sole model-only policy-correctness failure among 480 confirmation graphs using runtime lineage.Source: §E.3 · p. 33

E.4 Availability and assembly

  • A fixed fallback activates after specified artifact failures, serializes only the worker’s assigned segment, and is checked for schema validity, retention, position, and leakage.Component availability rises from 0.7333 without failover to 1.0 with failover.Source: §E.4 · p. 34
  • With validated artifacts, model composition supplies only 0.350 of authorized actions, while runtime assembly with the same artifacts reaches 1.000.Denied disclosure, local leakage, and unassigned-field counts are zero in every arm.Source: §E.4 · p. 34, Table 14 · p. 34

E.5 Policy changes and recovery

Policy-change studies compare rereading current policy with gates and one-shot repair, then tool-use experiments test runtime control under relayed attacks. Outcomes distinguish rejecting prohibited actions from supplying authorized replacements and preserving task utility.

E.5 Policy changes and recovery

  • In the policy-reread study, a version gate removes wrong commits but accepts only 83/120 required authorized actions, whereas rereading without the gate supplies every authorized action but leaves one wrong commit.The cached-policy control commits an action violating current policy in 50% of evaluations.Source: §E.5 · p. 35, Table 15 · p. 35
  • Rereading current policy supplies 120/120 authorized actions, while stale-proposal and one-repair arms supply 0/120; every repaired proposal fails the full repair contract.All three arms record zero wrong commits, object substitutions, and false trusted elevations.Source: §E.5 · p. 35, Table 16 · p. 36

F.1 Relay selection and execution control

  • On 24 independent Sonnet pairs, runtime control changes target commits by −0.875 [−1.00, −0.75] and final-state violations by −0.833 [−0.958, −0.667].Benchmark utility changes by +0.500 [0.292, 0.708], while legitimate-action supply and protocol conformance are unchanged.Source: §F.1 · p. 36

F.2 Task utility example

  • In the saved Sonnet pair, blocking the exact registered forwarding action preserves the lunch event and changes benchmark utility from 0 for native execution to 1 for gated execution.Across the 24 saved pairs, utility improves in 12, stays successful in nine, and stays unsuccessful in three; legitimate-action supply is unchanged in every pair.Source: §F.2 · p. 37, Table 18 · p. 37

F.3 Exposure across models

  • No model in the separate 36-trajectory-per-model exposure comparison meets the joint criteria for attack exposure, instrumentation, protocol, and utility.Sonnet and Haiku complete legitimate tasks at 0.750 and 0.556 while producing zero exact transient target events; Qwen produces four events but misses the exact-event-rate and protocol criteria.Source: §F.1 · p. 36, §F.3 · p. 38, Table 19 · p. 38

F.4 Attack prevention and task utility

The Qwen attack-family comparison finds fewer final-state violations under runtime control but also lower utility. In an independent-pair replication, low native attack exposure prevents confirmatory security conclusions, and equal observed utility does not establish non-inferiority.

F.4 Attack prevention and task utility

  • In the exploratory Qwen comparison, runtime control changes final-state violations by −0.5625 [−0.844, −0.281] and utility by −0.281 [−0.469, −0.094].Target-action proposals are equally frequent overall; the transient ledger records two executed attacks later overwritten in final state.Source: §F.4 · p. 38, Table 20 · p. 39

F.5 Generalization to independent pairs

  • The independent Qwen replication records an exact native target action in 1/32 cases, below the prespecified exposure thresholds, so its security results are descriptive.Utility is 11/32 in each arm, but the paired interval [−0.156, 0.125] cannot rule out a change worse than the −0.10 margin.Source: §F.5 · p. 39
  • In the independent replication, pooled final-state violations change by −0.094 [−0.250, 0.063] and legitimate-action supply by +0.094 [0, 0.219].The gate blocks the target action in one pair and never blocks it in the other attack families.Source: §F.5 · p. 40, Table 21 · p. 40

G Extended Related Work

Related work spans task capability, agent safety, privacy and policy-aware evaluation, multi-agent risk, compositional attacks, and runtime security. FlowReview brings these strands together by evaluating composed information against trusted authorization while preserving required capabilities.

G Extended Related Work

  • Agent frameworks and task and safety benchmarks span collaborative execution, real-world task completion, interactive risks, and tool-mediated security contexts.Privacy and policy-aware measures also make compliance or disclosure context part of evaluating successful execution.Source: G Extended Related Work · pp. 40–41
  • Existing privacy- and policy-aware evaluations distinguish safety from utility; FlowReview binds both outcomes to governed objects and a trusted authorization contrast.It also diagnoses how multi-agent composition disrupts that binding.Source: G Extended Related Work · p. 41
  • Multi-agent work identifies adversarial and emergent risks, while FlowReview isolates how individually assigned fragments can enable a downstream unauthorized action.Its suite varies read scope and contributors across homogeneous and heterogeneous teams.Source: G Extended Related Work · p. 41
  • Compositional-attack research motivates evaluating combined information in workflows and changing trusted authorization for the same recovered governed object.This connects composition failures to denying prohibited use without disabling authorized use.Source: G Extended Related Work · p. 42
  • Harness-security work covers persistent infrastructure, instruction injection, framework-dependent safety, and persistent-state conflicts; placement experiments isolate runtime lineage, permission interpretation, and assembly.These experiments examine preservation of authorized execution.Source: G Extended Related Work · p. 42
  • Information-flow and capability controls underpin enforcement, but FlowReview tests whether object identity and current trusted authorization reach the action boundary together.Its comparisons pair denied use with required authorized use and examine resolution and placement.Source: G Extended Related Work · p. 42

H Synthesis of Findings

The synthesis connects information available for review with the permission distinction that must survive execution. It distinguishes action-boundary readers and identifies how the tables organize the comparisons and their sampling units.

H Synthesis of Findings

  • Composition and contributor comparisons establish the need to resolve information jointly, while delegation and placement comparisons examine permission attribution and capability preservation.Table 22 organizes the contributions and supporting comparisons by measurement scope.Source: H Synthesis of Findings · p. 42, Table 22 · p. 43
  • Table 23 separates verbatim-release ladder outcomes from representation-study enforcement on the same proposals, including improvements, ties, and regressions.The ladder aggregates final-configuration trials; representation comparisons use 12 fixed proposals per model-by-transformation comparison.Source: H Synthesis of Findings · p. 43, Table 23 · p. 43
  • Table 24 groups outcomes by experimental setting and sampling unit, distinguishing exact-proposal delegation drift from any-role contract-study errors.Permission placement and assembly are separate comparisons.Source: Table 24 · p. 44

Related papers

Loading 2610.00371v1…