Skip to content

Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks

🕒 Published (v1): 2026-06-27 01:33 UTC · Source: Arxiv · link

Why this paper was selected

Audits confused-deputy failures in agent frameworks; practical security contribution to harness design

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

A cross-framework audit of LangChain/LangGraph, LlamaIndex, and Stripe Agent Toolkit shows all three ship capability gating (which tools are exposed) but none ships deterministic fail-closed per-call value authorization (whether this specific call with these arguments is allowed), creating a confused-deputy default. The paper introduces SCOPE GATE, a five-stage PDP/PEP that re-authorizes each model-emitted tool call against out-of-band operator policy before side effects execute.

Problem

LLM agents increasingly read untrusted content (retrieved docs, emails, web pages) while holding side-effecting tools (payments, CRM, email, infrastructure APIs). The core systems question: when a compromised model emits a tool call with attacker-chosen arguments, does the runtime check authorization on the concrete argument values before executing? The audited frameworks conflate tool exposure (capability gating) with authorization, creating a classic confused-deputy pattern where the untrusted model supplies both the action and the authorization fact.

Method

The author performs a public-source architecture audit of three agentic stacks at pinned commits, asking one narrow question: after the model emits a tool call, is there a deterministic fail-closed authorization check over concrete argument values before side effect? They then propose SCOPE GATE, a deterministic PDP/PEP implementing five ordered stages: (1) scope — unlisted tools deny; (2) authorization — value-constrained arguments checked against allowlists; (3) money ceiling — amount must be finite \(0 \leq a \leq ceiling\); (4) idempotency — required key must be present; (5) default deny — only calls passing all stages are allowed; any error treats as denial. Policy originates entirely outside the model's context window, write path, and influence.

Key Contributions

  • Public-source audit showing LangChain/LangGraph, LlamaIndex, and Stripe Agent Toolkit all provide capability gating by default but none provides fail-closed per-call value authorization by default
  • SCOPE GATE: a deployable five-stage PDP/PEP that verifies tool name, argument values, money ceiling, and idempotency against out-of-band policy before tool execution
  • 27-model sweep measuring ASR (attempted unauthorized action rate): deployment-tier models at mean ASRtask 0.603 vs. flagship 0.189
  • Task-aligned injection framing sharply increases ASR vs. naive injection across multiple models (e.g., gemma-3-12b-it: 0.000→0.571; mistral-large: 0.027→0.459)
  • Reproducible real-framework PoC showing the identical unauthorized payout call is executed under LangChain default dispatch but denied by SCOPE GATE

Results

  • 48-vector static bypass suite: 0/48 unauthorized vectors allowed at commit d9568ac (caught a real NaN fail-open in an earlier prototype)
  • 40-iteration adaptive attacker run (GLM-5.2): 0/29 unauthorized attempts allowed, 29 denied, 9 malformed/parse errors, 2 benign calls allowed
  • Benign control: 0/10 false-denies
  • Latam-GPT payment-agent containment: 10/10 unauthorized payout attempts denied at authz (acct_ATTACKER_999 ∉ {acct_MERCHANT_001})
  • Deployment-tier models (12 models): mean ASRtask 0.603; flagship mean (15 models): 0.189; deployment-tier exemplars gpt-4o-mini (1.000) and glm-4.5-air (1.000)
  • Task-aligned ∆ CI for gemma-3-12b-it: [0.444, 0.681], BH q<0.001, n=70; for mistral-large: [0.311, 0.545], BH q<0.001, n=74

Limitations

  • Containment is not a cure: SCOPE GATE does not prevent prompt injection, detect poisoned weights, or guarantee safe NL outputs — it bounds what a compromised model can do through governed tools
  • "0/48" and "0/29" are suite-bounded, not universal bypass impossibility proofs
  • Paired benchmark uses one author's corpus, one delivery vector, and single-turn scenarios
  • 27-model tier sweep is separate from the paired ∆ runs with no imputed missing cells
  • Stripe remote MCP server internals not audited; framework findings are public-source defaults, not asserted CVEs
  • Latam-GPT measured under bnb-4bit text-tool protocol (modality floor, not native function-calling ceiling); Meta reference comparison did not complete

Relevance to Harnesses / Meta-Harnesses

This paper provides the missing default-security analysis that any agent harness builder needs: it demonstrates that capability gating alone is insufficient and that harnesses must include a deterministic, out-of-band authorization layer between model output and tool execution. The SCOPE GATE design (scope → authz → money → idempotency → default deny) is directly applicable as a reference architecture for agent harness tool-dispatch security, and the measurement methodology (ASR as attempt rate, task-aligned injection framing) offers a evaluation template for harness safety testing.