aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents

• URL: http://arxiv.org/abs/2607.05518v1
• Date: Mon, 06 Jul 2026 18:00:49 GMT
• Title: aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents
• Abstract summary: I present aiAuthZ, an authorization gateway that moves the safety decision off the agent's host.<n>Every decision joins a SHA-256 hash-chained audit log, and each accepted message yields an HMAC-authenticated QR receipt.<n> residual attack success falls to 0% for all 15 models at no more than 0.03 ms of added decision latency.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: AI agents issue tool calls on the basis of text they cannot verify, so any party who controls part of the context can forge the appearance of authority. I evaluate 15 contemporary language models against eight attack scenarios derived from a published corpus of real agent incidents and find that refusal varies from 100% down to 38% across fully evaluated models; the most expensive model refused only half of the attacks despite a twentyfold price spread. I present aiAuthZ, an authorization gateway that moves the safety decision off the agent's host. Before a tool call executes, the gateway verifies caller identity with a per-message HMAC-SHA256 signature bound to a single-use nonce and a timestamp window, and it evaluates a role-based and argument-level policy that the agent can neither read nor modify. Every decision joins a SHA-256 hash-chained audit log, and each accepted message yields an HMAC-authenticated QR receipt that achieves 94% mean verification across eight transmission channels, with zero forgeries accepted in 25 wrong-key trials. With the gateway in place, residual attack success falls to 0% for all 15 models at no more than 0.03 ms of added decision latency. On the AgentDojo banking suite, aiAuthZ blocks all seven attacker-directed tool calls the evaluated agents emit, at the cost of one legitimate first-time payment, while a spotlighting baseline allows two injections to succeed. Across nine in-scope case studies from the same incident corpus, aiAuthZ blocks nine of nine, against four of nine for a policy baseline without identity binding. The gateway does not prevent a model from being deceived; it prevents a deceived model from acting beyond the verified user's authority on every call routed through it. The implementation and all experiments are released at https://github.com/Sports-Vision-Inc/aiAuthZ.

Related papers

• AcquireBound: Runtime Authorization for Resources Acquired by AI Agents [0.0]
  Post-fulfillment activation gap spans tool-mediated creation, inter-agent delegation, and agentic commerce.<n>We present AcquireBound, a provenance-bounded runtime authorization architecture.<n>We prove eight safety properties covering quarantine, backing, non-amplification, split non-evasion, crash/retry, refunds, epochs, and effect confinement.
  arXiv  Detail & Related papers  (2026-09-13T19:16:44Z)
• ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection [61.4148196085256]
  We present ROPE (Routed Origin Policy Enforcement), which is anchored in a structural notion of trust.<n>Our approach admits two provable guarantees: 1) at every step of a trajectory, no value whose only origin is attacker-writable content reaches an origin-guarded parameter, and 2) no rewording of an injection changes an admission decision.
  arXiv  Detail & Related papers  (2026-08-27T01:22:14Z)
• ADeptS-Bench: Measuring the Trustworthiness of Computer Use Agents Across Devices [48.36933831982682]
  We introduce ADeptS-Bench, a trustworthiness benchmark grounded in the ADEPTS capability framework.<n>The Safety stream provides paired benign/malicious tasks with threats embedded in the visual interface.<n>The Disambiguation stream evaluates whether agents seek clarification when intent is ambiguous.
  arXiv  Detail & Related papers  (2026-08-25T23:21:57Z)
• Bounded Agents: Delegation Security for Multi-Agent AI Systems [0.0]
  LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents.<n>At session start, the agent's permissions are set but remain static, and each request is evaluated independently.<n>A prompt injection poses a risk only if the agent has authority to perform such actions.
  arXiv  Detail & Related papers  (2026-08-16T18:38:00Z)
• NiyamAI - An Intent-Bound AI Agent with Cryptographically Verifiable Guardrails using Zero-Knowledge Proofs [0.20215383828623398]
  We introduce Niyam-AI, a framework that makes safety enforcement provable.<n>We evaluate Niyam-AI on 2,000 real-world scenarios from Agent-SafetyBench against NeMo Guardrails, Meta's Llama Prompt Guard 2, and OpenAI's GPT-OSS-Safeguard.<n>Niyam-AI wins 390 discordant scenarios against NeMo (vs 20 losses), 115 against Prompt Guard 2 (vs 13), and 384 against GPT-OSS-Safeguard.
  arXiv  Detail & Related papers  (2026-08-07T12:36:52Z)
• Capable but Careless: Do Computer-Use Agents Follow Contextual Integrity? [54.701199583505144]
  Cross-application access creates a privacy risk that has been largely overlooked.<n>We introduce AgentCIBench, an evaluation harness that turns this risk into executable, deterministically scored scenarios.<n>We evaluate 15 frontier agents and find a surprisingly high failure rate.
  arXiv  Detail & Related papers  (2026-06-22T11:36:58Z)
• Hallucination as Exploit: Evidence-Carrying Multimodal Agents [10.441697487723568]
  Multimodal agents increasingly choose tool calls from screenshots, documents, and webpages, where a false perceptual claim can turn from an answer-quality error into an authorization failure.<n>We propose evidence-carrying multimodal agents (ECA), which treat free-form model text as inadmissible evidence.<n>ECA converts opaque model belief into auditable residuals at the verifier, schema, and implementation levels.
  arXiv  Detail & Related papers  (2026-05-18T23:40:43Z)
• Do Coding Agents Understand Least-Privilege Authorization? [14.240332406666779]
  We study whether current models can infer authorization boundaries themselves.<n>We show that frontier models often omit permissions required by the execution chain while also granting unused or sensitive accesses.<n>We propose Sufficiency-Tightness Decomposition, which first generates a coverage-oriented policy and then audits each granted entry for grounding and sensitivity.
  arXiv  Detail & Related papers  (2026-05-14T14:05:58Z)
• Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents [0.0]
  Open Agent Passport (OAP) is an open specification and reference implementation that intercepts tool calls synchronously before execution.<n>OAP enforces authorization decisions in a measured median of 53 ms (N=1,000)<n>The same infrastructure that enforces security constraints also enforces quality gates, operational contracts, and compliance controls.
  arXiv  Detail & Related papers  (2026-03-21T21:34:09Z)
• Zero-Permission Manipulation: Can We Trust Large Multimodal Model Powered GUI Agents? [6.9619059967556725]
  Action Rebinding is a novel attack that allows a seemingly-benign app with zero dangerous permissions to rebind an agent's execution.<n>We weaponize the agent's task-recovery logic and Android's UI state preservation to orchestrate programmable, multi-step attack chains.<n>Our results demonstrate a 100% success rate for atomic action rebinding and the ability to reliably orchestrate multi-step attack chains.
  arXiv  Detail & Related papers  (2026-01-18T10:54:54Z)
• Assimilation Matters: Model-level Backdoor Detection in Vision-Language Pretrained Models [71.44858461725893]
  Given a model fine-tuned by an untrusted third party, determining whether the model has been injected with a backdoor is a critical and challenging problem.<n>Existing detection methods usually rely on prior knowledge of training dataset, backdoor triggers and targets.<n>We introduce Assimilation Matters in DETection (AMDET), a novel model-level detection framework that operates without any such prior knowledge.
  arXiv  Detail & Related papers  (2025-11-29T06:20:00Z)
• Holistic Agent Leaderboard: The Missing Infrastructure for AI Agent Evaluation [87.47155146067962]
  We provide a standardized evaluation harness that orchestrates parallel evaluations across hundreds of tasks.<n>We conduct three-dimensional analysis spanning models, scaffolds, and benchmarks.<n>Our analysis reveals surprising insights, such as higher reasoning effort reducing accuracy in the majority of runs.
  arXiv  Detail & Related papers  (2025-10-13T22:22:28Z)
• Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition [101.86739402748995]
  We run the largest public red-teaming competition to date, targeting 22 frontier AI agents across 44 realistic deployment scenarios.<n>We build the Agent Red Teaming benchmark and evaluate it across 19 state-of-the-art models.<n>Our findings highlight critical and persistent vulnerabilities in today's AI agents.
  arXiv  Detail & Related papers  (2025-07-28T05:13:04Z)
• Malicious Agent Detection for Robust Multi-Agent Collaborative Perception [52.261231738242266]
  Multi-agent collaborative (MAC) perception is more vulnerable to adversarial attacks than single-agent perception. We propose Malicious Agent Detection (MADE), a reactive defense specific to MAC perception. We conduct comprehensive evaluations on a benchmark 3D dataset V2X-sim and a real-road dataset DAIR-V2X.
  arXiv  Detail & Related papers  (2023-10-18T11:36:42Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.