Source-linked AI summary
Same Operation, Different Permission: Evaluating Whether Guardrails Honor Authorization
Huihao Jing, Shaojin Chen, Wenbin Hu, Yuxuan Liu, Haochen Shi, Zhongwei Xie, Haoran Li, Yangqiu Song
TL;DR
Agent actions can be legitimate or forbidden depending on authorization, making it important to evaluate whether guardrails block unauthorized actions while allowing the same actions under valid permission. AuthorizationPairs combines expert-labeled permission contrasts, verified operations, and native-policy requests, tracking correctness, usability, effects, and requests across changes. The experiments find that output repair can restore usable decisions while changing which lawful requests are honored, and that an extra reviewer can veto valid authorization.
Problem
Guardrails must decide whether an agent’s action is authorized, but evaluations have limited evidence on whether they both block unauthorized actions and allow the same actions under valid permission.
Source: §1 · p. 1Method
AuthorizationPairs combines expert-labeled natural-language scenarios with verified operations and externally sourced native-policy requests, tracking decision correctness, usability, effects, and request-level changes.
Source: §1 · pp. 1–2Results
Takeaways & Limitations
Evaluate guardrails separately for blocking forbidden effects, returning usable decisions, and preserving a predeclared set of lawful requests.
Source: §6 · p. 8Each case is a single review decision, so multi-step agent workflows remain future work.
Source: Limitations · p. 9
Abstract
from arXiv · showhide
As language-model agents write code, move money and change records on behalf of users, deciding whether an action is authorized has become a central safety problem. Guardrails are often placed in front of these actions, yet few evaluations ask whether their decisions follow authorization: blocking unauthorized actions while still allowing the same actions under valid permission. We introduce \bench{}, a benchmark that contrasts authorization evidence for the same operation in its language track. It combines expert-annotated natural-language scenarios with executed and verified operations, plus externally sourced native-policy requests. \bench{} checks each decision for correctness, usability and resulting effect, and tracks each request across guardrail changes. Our experiments show that many blocked operations stem from failed reviews, not correct denials. Repairing the output format restores usable decisions but changes which authorized requests are honored, and adding a second reviewer removes some errors while rejecting valid authorization. Guardrails should therefore be evaluated on both the unauthorized actions they stop and the authorized actions they let through.
1 Introduction
An agent action can be lawful or forbidden depending on authorization, so guardrails must both block unauthorized actions and preserve legitimate work. AuthorizationPairs evaluates those decisions through fixed-operation permission contrasts, usable-review outcomes, and request-level changes.
1 Introduction
- The language track contains fifty scenarios with four contexts each, independently labeled by three security experts; allowed operations run locally and their effects are independently checked.The 200 contexts comprise two lawful and two forbidden contexts per scenario.Source: §1 · p. 1
- The native-policy track adds 1,594 externally sourced OpenFGA and Cedar requests, while stable identifiers track which requests each change helps or harms.The study evaluates eight configurations and asks whether decisions follow authorization, whether blocks reflect correct denials, and whether changes preserve valid authorization.Source: §1 · p. 2
- AuthorizationPairs holds each operation fixed while contrasting lawful and forbidden evidence, so an always-allow or always-block reviewer cannot score well.Executing and checking language-track decisions ties judgments to real effects.Source: §1 · p. 2
- Structured review left 117 to 124 of 160 inputs without usable decisions for Qwen3.5-9B and 48 to 50 for Qwen3.5-27B, stopping each operation.Schema decoding made every decision usable in all six runs, exposing the permission judgments underneath.Source: §1 · p. 2
- In five of six runs, direct-to-schema review both gained and lost lawful completions, with net changes from −3 to +27; adding Safeguard removed one incorrect approval but vetoed 171 lawful requests.Aggregate totals can hide requests that stop being honored after a change.Source: §1 · p. 2
2 Related Work
Prior work covers access control, agent safety, policy compliance, contrastive testing, and oversight. This paper connects permission contrasts to review usability, executed effects, and request-level records across guardrail changes.
Access control and policy language
- Access-control research established least privilege and policy-based decisions, while later work translates natural-language requirements into formal rules and tests permission-respecting model behavior in several domains.The paper’s language track links fixed-operation permission contrasts to usable review decisions, verified effects, and request-level intervention records.Source: §2 · p. 2
Guardrails and agent evaluation
- Guardrail and agent benchmarks assess rule enforcement, policy-compliant trajectories, security, task behavior, interactive safety, or risky tool use, while this study focuses on one operation under contrasting permissions.It also tracks decision availability and request identity across guardrail changes.Source: §2 · p. 2
Contrastive testing and oversight
- Contrastive testing and oversight research provide related approaches; this work makes decision availability explicit and separates output failures from usable denials.The cited approaches include contrast sets, metamorphic testing, access-control verification, auditing, and fallback.Source: §2 · p. 2
3 The AuthorizationPairs Benchmark
AuthorizationPairs combines fixed-operation permission contrasts, expert reference labels, native-policy requests, and verified operation effects. Its records distinguish judgments, usable decisions, and outcomes while preserving request and scenario identity.
3.1 Case format
- Each language scenario keeps the request, policy, and effect fixed while changing authorization evidence across four contexts, testing both lawful paths and their forbidden counterparts.Contexts vary grant scope, status, issuer, or irrelevant evidence; stable identifiers support tracking across changes.Source: §3.1 · p. 3
3.2 Reference labels
- Three security and access-control annotators labeled all 200 language contexts independently; they agreed on 186, and adjudication resolved 14 non-unanimous cases.Two encoded evaluators reproduce 198 determinate labels, while two contexts remain unresolved under the stricter issuer reading.Source: §3.2 · p. 3
3.3 Native-policy track
- The native-policy track contains 1,594 distinct OpenFGA and Cedar requests from 47 source applications and sixty policy encodings, with 379 development and 1,215 test requests.Native policy engines reproduce every reference label.Source: §3.3 · p. 3
3.4 Execution and effect checks
- In the language track, an ALLOW runs the operation locally and independent checks verify effects; unusable or other non-ALLOW outputs leave it unexecuted.The evaluation separately records judgment correctness, decision availability, and resulting effect; native-policy cases have no executable effect.Source: §3.4 · pp. 3–4
4 Evaluation Protocol
The evaluation compares guardrail configurations and review interfaces on shared inputs, reporting correctness, usability, effects, and request-level changes. Its protocol also tests native-policy requests across individual reviewers and reviewer orders.
4.1 Guardrail configurations
- The study compares eight configurations, including general models, policy-specific guardrails, and a fixed-taxonomy control, while treating each complete configuration as the comparison unit.Configurations share a context limit, one attempt, and a deadline; prompts and reasoning settings differ.Source: §4.1 · p. 4
4.2 Outcome measures
- Outcome measures distinguish usable correctness, unavailable decisions, false denials, and executed lawful or forbidden effects; interface changes are compared by matching request identities.Gains and losses are retained separately, and paired analyses keep scenario clusters intact.Source: §4.2 · p. 4
- With zero forbidden effects in both Qwen3.5-9B interfaces, schema review yields 71 lawful completions versus structured review’s 10.Structured review blocks 58 forbidden requests through unavailable decisions and 22 through correct denials.Source: §4.2 · p. 4
4.3 Matched interface study
- The matched interface study uses two models, three seeds, temperature 0.7, and identical 160-input test sets; Figure 1 summarizes lawful requests gained and lost across six changes.Its bars and labels show means over seeds, with whiskers spanning observed minima and maxima.Source: §4.3 · pp. 4–5, Figure 1 · p. 5
4.4 Native-policy evaluation
- For native-policy evaluation, three reviewers each judge all 1,215 test requests, then their decisions are combined under an all-must-allow rule across fifteen orders.Cached decisions allow the compositions to be replayed without new inference.Source: §4.4 · p. 5
5 Results
Results show that guardrail decisions vary in authorization accuracy, usability, and the lawful requests they preserve. Interface repairs and additional reviewers can remove some errors while also changing which authorized requests are honored.
5.1 RQ1: Do decisions follow authorization?
- Qwen3Guard completes every lawful request but also allows 72 of the 80 forbidden ones.Source: §5.1 · p. 5
- On the language track, Qwen3.5-27B and Safeguard match all 160 labels; on native-policy requests, Qwen3.5-27B scores 99.1% correct, Safeguard 84.2%, and Qwen3.5-9B 69.4%.Source: §5.1 · p. 5
- Native-policy errors include an incorrect approval for a parent folder and a false denial that misses an indirect submitter-to-editor-to-viewer permission path.Source: §5.1 · pp. 5–6
5.3 RQ3: Do repairs and additional review preserve valid authorization?
- Adding Qwen3.5-27B after Qwen3.5-9B removes 260 of 261 incorrect approvals at a cost of eight lawful approvals; adding Safeguard after Qwen3.5-27B rejects 171 lawful requests.Source: Figure 2 · p. 6, §5.3 · p. 8
5.2 RQ2: Correct denial or interface failure?
- Structured review leaves 117–124 of 160 inputs unusable for Qwen3.5-9B and 48–50 for Qwen3.5-27B, while schema decoding makes every decision usable in all six runs.Source: §5.2 · p. 6
5.3 RQ3: Do repairs and additional review preserve valid authorization?
- In five of six direct-to-schema runs, lawful-request gains came with losses; net changes ranged from −3 to +27, and only one gain remained significant after correction.Source: §5.3 · p. 7
- Request identities expose which authorizations survive interface changes, while the figure summarizes transition direction and scale and the table retains each seed’s outcomes.Source: §5.3 · pp. 7–8
6 Discussion
The discussion recommends matching repairs to the failure type and evaluating changes against both forbidden effects and designated lawful requests. Additional oversight trades lawful approvals for fewer incorrect approvals, so the required permission boundary and error costs matter.
6 Discussion
- Match repairs to the failure: fix unavailable outputs at the interface, investigate incorrect approvals, and use false denials as regression tests for permission evidence paths.Source: §6 · p. 8
- A guardrail change should block designated forbidden effects, return usable decisions, and preserve a fixed set of lawful requests; gains elsewhere cannot substitute for a lost required request.Source: §6 · p. 8
- Under a zero-incorrect-approval requirement, Qwen3.5-27B followed by Safeguard keeps 586 lawful approvals, while adding Qwen3.5-9B as a third reviewer leaves 502.The best choice also depends on forbidden-request frequency and the relative cost of each error.Source: §6 · p. 8
7 Conclusion
AuthorizationPairs tests whether guardrails honor authorization by holding the operation fixed while permission changes; the experiments show that usable output and preserved authorization are separate requirements.
7 Conclusion
- AuthorizationPairs keeps each operation fixed and changes only its authorization evidence to test whether guardrails honor permission.The contrasts distinguish correct denials from blocks caused by failed reviews.Source: §7 · p. 8
- Output repair restores usable decisions but changes which authorized requests are honored.An extra reviewer removes some permission errors while vetoing valid authorization.Source: §7 · p. 8
- Guardrail evaluations should check usable output and preserved authorization as separate requirements.Source: §7 · p. 9
Limitations
The authors identify limits in scenario drafting, annotator perspective, policy scope, and evaluation setting.
Limitations
- AI assistance was used to draft the fifty language scenarios.Source: Limitations · p. 9
- Security-specialist annotators may interpret some policies differently from clinical, legal, or financial practitioners.Two issuer readings remain unresolved, and native-policy references apply only to the supplied formal policies.Source: Limitations · p. 9
- Public examples may overlap with model training data, and model comparisons concern complete configurations rather than isolated settings.Each case is one review decision; multi-step workflows remain future work.Source: Limitations · p. 9
Ethical Considerations
The appendix documents the study’s ethical practices, reproducibility artifacts, evaluation implementations, and supplementary checks. It also reports validation of references and complete native-test outcomes for the fixed public-source cohort.
Ethical Considerations
- Experiments used fictional identities and simulated environments; no real payments, external deliveries, patient-record access, or production deployment occurred.AI tools assisted with drafting, code, analysis, and writing; human annotators supplied reference labels.Source: Ethical Considerations · p. 9
A Reproduction Guide; A.1 Artifacts and evaluation units
- The supplementary material follows the evidence chain, while release artifacts preserve inputs, responses, execution fixtures, and evaluation records.The release has 1,794 inputs, and immutable manifests bind study inputs, prompts, model revisions, parameters, and raw-output hashes.Source: A Reproduction Guide · p. 11, §A.1 · p. 11
A.2 Generation and native interfaces
- Native interfaces use configuration-specific output mappings, while comparisons reflect complete model configurations rather than isolated interventions.The configurations differ in reasoning settings, decoding, and output limits.Source: §A.2 · pp. 11–12
A.3 Executable observations
- Language effects are executed locally and checked independently; unavailable decisions prevent execution but are not usable denials.Native-policy cases measure permission judgments and have no application business-effect score.Source: §A.3 · p. 12
B.1 Language references and semantic uncertainty
- Two independent evaluators reproduce 198 determinate language labels, while two readings remain unresolved under strict transcription.The 198 determinate cases match the reference labels; alternative interpretations of the two unresolved cases are retained.Source: §B.1 · p. 12
B.2 Automated annotation cross-check
- Qwen3.5-9B produced 196 usable annotations across 200 public language cases, with 179 agreements and seventeen disagreements against expert labels.The automated annotations do not replace the expert labels.Source: §B.2 · p. 13
B.3 Formal-native sources and native replay
- OpenFGA and Cedar examples were replayed against their native engines, and the connected native split contains 379 development and 1,215 test inputs.The test includes 22 same-policy, same-query permit/deny groups across fourteen exact models; these are not independent single-factor interventions.Source: §B.3 · p. 13
C.1 Language configurations; C.2 Development observations; C.3 Complete native test
- Equal-weight source-group accuracy was 67.6% for Qwen3.5-9B, 99.3% for Qwen3.5-27B, and 87.2% for Safeguard on the fixed native cohort.The original configurations share the same test inputs; development observations are not pooled with test scores. Each model’s full-test score uses a new response, and Safeguard’s six output-limit terminations are unavailable decisions.Source: §C.3 · pp. 13–14, §C.1 · p. 13, §C.2 · p. 13
C.4 Source-defined permission error examples
Schema review restores usable decisions while changing which lawful requests are completed; replicated comparisons and request-level tracking show that aggregate gains can include regressions.
C.4 Source-defined permission error examples
- A source-checked OpenFGA example incorrectly allows root viewing because child ownership supplies no root-view route, while Safeguard blocks a valid submitter-to-view path.The replay checks establish the encoded permission boundary, not an application transaction or an independently reviewed language interpretation.Source: §C.4 · p. 14
D Original Matched-Interface Study
- Structured review produced 125 unavailable decisions—58 on forbidden and 67 on lawful cases—while only 22 forbidden requests received usable correct denials.The post hoc schema condition added native JSON-schema decoding without adding permission rules or reference facts.Source: D Original Matched-Interface Study · p. 15
- 34/40 full-quartet usable correctness for schema review, versus 22/40 for direct review, 0/40 for structured review, and 11/40 for NeMo self-check; it completed 71 lawful tasks with zero forbidden effects.Schema review retains all ten structured-review successes and gains 61; compared with direct review, it retains 58 lawful successes, gains thirteen, and loses two.Source: D Original Matched-Interface Study · pp. 15–16
E Replicated Matched Interfaces
- 21 of 36 repeated-study contrasts were significant, including all 18 involving unconstrained structured review; only one of six direct-to-schema contrasts was significant.Seed repetitions do not increase the independent scenario count, and these analyses describe the authored cohort rather than new-scenario generalization.Source: E Replicated Matched Interfaces · pp. 17–18
F Reporting Resolution and Reviewer Selection
- Matching lawful requests by identity shows two losses and thirteen gains from direct to schema review, despite the aggregate increase in completions.Given 60 direct and 71 schema successes, the possible overlap permits zero to nine losses; the observed overlap is 58.Source: F Reporting Resolution and Reviewer… · p. 19
F.1 All ordered cached compositions
Cached reviewer compositions trade incorrect approvals against lawful nonapprovals, and their apparent cost advantages depend on chosen severity and token-price assumptions.
All ordered cached compositions
- Qwen3.5-9B followed by Qwen3.5-27B removes 260 incorrect approvals and loses eight lawful approvals; the reverse removes none and loses 109.These are counterfactual selections of cached independent responses, not live sequential inference or business execution.Source: §F.1 · p. 19
- For Qwen3.5-27B versus its Safeguard pair, the zero-token-price break-even severity ratio is r = 171, as incorrect approvals change from one to zero and lawful nonapprovals from ten to 181.The cost model also weights selected input and output tokens; those totals do not measure future latency or serving prices.Source: §F.1 · p. 20
- The cost-grid selections are post hoc illustrations, not independent deployment validation; transporting conditional error rates to another deployment is an assumption.A joint requirement of zero incorrect approvals and zero unavailable decisions is infeasible in this candidate set.Source: §F.1 · p. 20
- Compared with Qwen3.5-27B alone, placing Qwen3.5-9B first saves 880,080 selected output tokens (24.96%), but loses 109 lawful approvals and selects 2,087,957 extra input tokens.Separately, Qwen3.5-27B is selected with 265 lawful nonapprovals and five unavailable decisions; this is assumption-dependent, not a deployment recommendation.Source: §F.1 · pp. 20–21
- Qwen3.5-27B followed by Safeguard removes one incorrect approval but loses 171 lawful approvals; reversing the order removes twelve and loses two.Adding a third reviewer to the pair loses another 84 lawful approvals without further observed protection.Source: §F.1 · p. 19, Table 9 · p. 21
G Paired Retention and Cohort Sensitivity
Paired request tracking finds cohort-specific gains and losses across interface changes; bounded supporting studies add calibration and controls but are not pooled with the primary tests.
G Paired Retention and Cohort Sensitivity
- 13.75 percentage points is the direct-to-schema net completion change, with a scenario-bootstrap interval of 5.00 to 23.75 points; the observed comparison retains 58 lawful successes, loses two, and gains thirteen.Excluding two unresolved issuer contexts preserves the two losses and thirteen gains, with an interval of 5.06 to 24.68 points.Source: G Paired Retention and Cohort… · pp. 21–22
- Across the original eight configurations, both gains and losses occur in nine of 28 unordered pairs, so aggregate completion changes can conceal request-level regressions.The original and matched-interface blocks are not joined into a matched causal experiment.Source: G Paired Retention and Cohort… · p. 21, Figure 7 · p. 22
- The paired scenario sign-flip test gives p = 0.015625, but its unadjusted result assumes independent scenario clusters and exchangeable directions and does not measure new-scenario generalization.The test enumerates 1,024 sign assignments across ten nonzero scenarios.Source: G Paired Retention and Cohort… · pp. 21–22
H Bounded Supporting Studies and Archive
- Structural calibration shows that positive participation alone does not establish that a grant covers the executed effect; seeded faulty checkers test distinct grant-validity probes.The seven faults are calibration cases, not discovered product vulnerabilities.Source: H Bounded Supporting Studies and Archive · p. 22
- In the bounded strong-model study, 27B thinking at 16K output completes 32/32 direct and 31/32 extraction tasks with zero unauthorized effects; context and deadline also change.These known-input repetitions add no new language scenarios.Source: H Bounded Supporting Studies and Archive · p. 23
- Supporting studies report no incremental detection benefit from the out-of-request beneficiary countercheck; separate runtime and BashArena tracks test native approval callbacks and task outcomes under bounded conditions.These studies are not pooled with the primary tests, and the BashArena experiment has four tasks and eight episodes.Source: H Bounded Supporting Studies and Archive · pp. 22–23
- Explicit pairing as repair feedback does not consistently improve selection, and frozen effect-preview interventions satisfy none of their registered improvement rules.The reported control results are retained alongside a separate thinking Qwen3.5-27B control that correctly handles all 64 structured test inputs.Source: H Bounded Supporting Studies and Archive · p. 23