ACLE-MCP: Attested Capability Leases for Execution-Time Trust in Remote LLM Tool Use

• URL: http://arxiv.org/abs/2609.02690v1
• Date: Wed, 02 Sep 2026 14:58:17 GMT
• Title: ACLE-MCP: Attested Capability Leases for Execution-Time Trust in Remote LLM Tool Use
• Abstract summary: OAuth authorization alone does not ensure that a later tool call is executed by the provider-side workload that the relying party intended to trust.<n>We present ACLE-MCP, an invocation-scoped architecture that couples delegated authorization, workload appraisal, and resource-side execution admission.
• Score: 29.860376266824872
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Remote Model Context Protocol (MCP) services enable large language model agents to invoke external tools, but OAuth authorization alone does not ensure that a later tool call is executed by the provider-side workload that the relying party intended to trust. An endpoint may remain authorized even after execution shifts to a substituted workload, relies on stale appraisal state, reuses authority transferred from another sender, or traverses an undeclared downstream component. We call this problem the post-authorization execution trust gap. We present ACLE-MCP, an invocation-scoped architecture that couples delegated authorization, workload appraisal, and resource-side execution admission. For protected calls, ACLE-MCP issues a short-lived, sender-constrained capability lease that binds the expected workload, freshness requirement, operation, object and parameter bounds, downstream constraints, and receipt obligations. A provider-side Execution Gate consumes the lease immediately before protected tool logic begins. We implement a runnable prototype with Keycloak/OIDC validation, an MCP Python SDK server, and an optional vTPM quote-verification backend. Controlled security experiments and an agent tool-use extension show that weaker authorization or connect-time attestation modes leave distinct post-authorization attacks open, whereas full ACLE-MCP blocks all evaluated attack families while preserving all benign tasks. In the locally simulated agent extension, the complete design increases request-level pooled p95 latency on normal allowed calls by 25.7% relative to OAuth-only. These results indicate that invocation-time binding between call authority and current workload state is a practical complement to OAuth-protected remote tool use.

Related papers

• ROPE: Routed Origin Policy Enforcement against Indirect Prompt Injection [61.4148196085256]
  We present ROPE (Routed Origin Policy Enforcement), which is anchored in a structural notion of trust.<n>Our approach admits two provable guarantees: 1) at every step of a trajectory, no value whose only origin is attacker-writable content reaches an origin-guarded parameter, and 2) no rewording of an injection changes an admission decision.
  arXiv  Detail & Related papers  (2026-08-27T01:22:14Z)
• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents [76.4694046738862]
  TokenWall is a runtime defense framework that acts as a semantic firewall over agent token flows.<n>We show that TokenWall reduces attack success rate to 12.5% while maintaining a 97.4% benign executable pass rate without human confirmation.
  arXiv  Detail & Related papers  (2026-07-09T12:18:40Z)
• Sovereign Assurance Boundary: Certificate-Bound Admission for Agentic Infrastructure [2.124730017640531]
  Sovereign Assurance Boundary is a certificate-bound runtime admission layer for autonomous execution authority.<n>We detail the airlock-broker architecture, formalize its admission and revocation invariants, and report preliminary feasibility measurements from a Go prototype.
  arXiv  Detail & Related papers  (2026-06-10T03:49:57Z)
• Heartbeat-Bound Hierarchical Credentials: Cryptographic Revocation for AI Agent Swarms [0.0]
  Existing credential revocation mechanisms, OAuth2.0 introspection, OCSP, and W3C Status Lists, require network connectivity to a central authority.<n>We present Heartbeat-Bound Hierarchical Credentials (HBHC), a cryptographic protocol that binds credential validity to periodic parent liveness.
  arXiv  Detail & Related papers  (2026-05-20T05:03:03Z)
• Securing LLM Agents Need Intent-to-Execution Integrity [49.490963596514185]
  We argue that securing LLM agents requires defining an end-to-end correctness property that specifies when an agent's execution faithfully reflects the user's intent.<n>We observe that LLM agents are structurally analogous to compilers, where security violations correspond to mis-executions that do not preserve user intent.<n>We derive four integrity properties that must hold simultaneously: emphTool Integrity, emphInstruction Integrity, emphJudgment Integrity, and emphData Flow Integrity.
  arXiv  Detail & Related papers  (2026-05-16T12:53:31Z)
• CapSeal: Capability-Sealed Secret Mediation for Secure Agent Execution [1.9473631530390483]
  CapSeal is a capability-sealed secret mediation architecture that replaces direct secret access with constrained invocations through a local trusted broker.<n>We describe a Rust prototype integrated with an MCP-facing adapter, formulate conditional security goals for non-disclosure, constrained use, replay resistance, and auditability.
  arXiv  Detail & Related papers  (2026-04-18T00:23:32Z)
• OpenPort Protocol: A Security Governance Specification for AI Agent Tool Access [11.289770127178882]
  This paper introduces OpenPort Protocol, a governance-first specification for exposing application tools through a secure server-side gateway.<n>OpenPort defines authorization-dependent discovery, stable response envelopes with machine-actionable texttagent.* reason codes, and an authorization model combining integration credentials, scoped permissions, and ABAC-style policy constraints.<n>For write operations, OpenPort specifies a risk-gated lifecycle that defaults to draft creation and human review, supports time-bounded auto-execution under explicit policy, and enforces high-risk safeguards including preflight impact binding and idempotency
  arXiv  Detail & Related papers  (2026-02-22T05:16:40Z)
• Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents [0.6747475365990533]
  In agentic settings reasoning, prompt injection, or multi-agent orchestration can silently expand privileges.<n>We introduce Agentic JWT (A-JWT), a dual-faceted intent token that binds each agent's action to verifiable user intent.<n>A-JWT carries an agent's identity as a one-way hash derived from its prompt, tools and configuration.
  arXiv  Detail & Related papers  (2025-09-16T23:43:24Z)
• Progent: Programmable Privilege Control for LLM Agents [46.31581986508561]
  We introduce Progent, the first privilege control framework to secure Large Language Models agents.<n>Progent enforces security at the tool level by restricting agents to performing tool calls necessary for user tasks while blocking potentially malicious ones.<n>Thanks to our modular design, integrating Progent does not alter agent internals and only requires minimal changes to the existing agent implementation.
  arXiv  Detail & Related papers  (2025-04-16T01:58:40Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.