{"id":"https://openalex.org/W7225635700","doi":"https://doi.org/10.21203/rs.3.rs-11676427/v1","title":"Fail-Closed Authorization for Tool-Using AI Agents: A Capability Contract and Case Study","display_name":"Fail-Closed Authorization for Tool-Using AI Agents: A Capability Contract and Case Study","publication_year":2026,"publication_date":"2026-11-10","ids":{"openalex":"https://openalex.org/W7225635700","doi":"https://doi.org/10.21203/rs.3.rs-11676427/v1"},"language":"en","primary_location":{"id":"doi:10.21203/rs.3.rs-11676427/v1","doi":"https://doi.org/10.21203/rs.3.rs-11676427/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-11676427/v1","pdf_url":"https://www.researchsquare.com/article/rs-11676427/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://www.researchsquare.com/article/rs-11676427/latest.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5161330181","display_name":"Andrey Lesnikov","orcid":"https://orcid.org/0009-0004-7583-4314","observed_orcids":["https://orcid.org/0009-0004-7583-4314"]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Andrey Lesnikov","raw_affiliation_strings":["Independent Researcher"],"raw_orcid":"https://orcid.org/0009-0004-7583-4314","affiliations":[{"raw_affiliation_string":"Independent Researcher","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5161330181"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.9218999743461609,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10927","display_name":"Access Control and Trust","score":0.9218999743461609,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.033399999141693115,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.02850000001490116,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/ai-agent-security","display_name":"AI agent security","score":0.8220000267028809},{"id":"https://openalex.org/keywords/llm-based-agents","display_name":"LLM agents","score":0.7519999742507935},{"id":"https://openalex.org/keywords/policy-evaluation","display_name":"policy evaluation","score":0.4259999990463257},{"id":"https://openalex.org/keywords/mutation-testing","display_name":"mutation testing","score":0.6029999852180481},{"id":"https://openalex.org/keywords/role-based-access-control","display_name":"role-based access control","score":0.5929999947547913},{"id":"https://openalex.org/keywords/agentdojo","display_name":"AgentDojo","score":0.8069999814033508}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.675599992275238},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5940999984741211},{"id":"https://openalex.org/C98184364","wikidata":"https://www.wikidata.org/wiki/Q1780131","display_name":"Argument (complex analysis)","level":2,"score":0.5031999945640564},{"id":"https://openalex.org/C108759981","wikidata":"https://www.wikidata.org/wiki/Q788590","display_name":"Authorization","level":2,"score":0.5008000135421753},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.4659999907016754},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.44350001215934753},{"id":"https://openalex.org/C2777210771","wikidata":"https://www.wikidata.org/wiki/Q4927124","display_name":"Block (permutation group theory)","level":2,"score":0.43950000405311584},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.3506999909877777},{"id":"https://openalex.org/C2776213154","wikidata":"https://www.wikidata.org/wiki/Q13370881","display_name":"Verdict","level":2,"score":0.349700003862381},{"id":"https://openalex.org/C2780416260","wikidata":"https://www.wikidata.org/wiki/Q2063","display_name":"JSON","level":2,"score":0.3305000066757202},{"id":"https://openalex.org/C2777735758","wikidata":"https://www.wikidata.org/wiki/Q817765","display_name":"Path (computing)","level":2,"score":0.3301999866962433},{"id":"https://openalex.org/C2777267654","wikidata":"https://www.wikidata.org/wiki/Q3519023","display_name":"Test (biology)","level":2,"score":0.3021000027656555},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.29899999499320984},{"id":"https://openalex.org/C42475967","wikidata":"https://www.wikidata.org/wiki/Q194292","display_name":"Operations research","level":1,"score":0.29660001397132874},{"id":"https://openalex.org/C107101626","wikidata":"https://www.wikidata.org/wiki/Q842234","display_name":"Full disclosure","level":2,"score":0.2924000024795532},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.28110000491142273},{"id":"https://openalex.org/C2776904630","wikidata":"https://www.wikidata.org/wiki/Q356336","display_name":"Adept","level":3,"score":0.2574999928474426}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.21203/rs.3.rs-11676427/v1","doi":"https://doi.org/10.21203/rs.3.rs-11676427/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-11676427/v1","pdf_url":"https://www.researchsquare.com/article/rs-11676427/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},{"id":"doi:10.5281/zenodo.24075885","doi":"https://doi.org/10.5281/zenodo.24075885","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24075885","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},{"id":"doi:10.5281/zenodo.24075886","doi":"https://doi.org/10.5281/zenodo.24075886","is_oa":true,"landing_page_url":"https://doi.org/10.5281/zenodo.24075886","pdf_url":null,"source":{"id":"https://openalex.org/S4306400562","display_name":"Zenodo (CERN European Organization for Nuclear Research)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I67311998","host_organization_name":"European Organization for Nuclear Research","host_organization_lineage":["https://openalex.org/I67311998"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.21203/rs.3.rs-11676427/v1","doi":"https://doi.org/10.21203/rs.3.rs-11676427/v1","is_oa":true,"landing_page_url":"https://doi.org/10.21203/rs.3.rs-11676427/v1","pdf_url":"https://www.researchsquare.com/article/rs-11676427/latest.pdf","source":{"id":"https://openalex.org/S4306525896","display_name":"Research Square","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Research Square","raw_type":"posted-content"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.47620001435279846,"display_name":"Peace, justice, and strong institutions"}],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7225635700.pdf","grobid_xml":"https://content.openalex.org/works/W7225635700.grobid-xml"},"referenced_works_count":1,"referenced_works":["https://openalex.org/W4411091733"],"related_works":["https://openalex.org/W7166722659","https://openalex.org/W7171371499","https://openalex.org/W7212428651","https://openalex.org/W7214235244","https://openalex.org/W7214974942","https://openalex.org/W7160332217","https://openalex.org/W7216289026","https://openalex.org/W7214576473","https://openalex.org/W7204187668","https://openalex.org/W7167825513"],"abstract_inverted_index":{"Abstract":[0],"For":[1],"tool-using":[2],"LLM":[3],"agents":[4],"the":[5,21,44,93,109,136,144,155,178,260],"decisive":[6],"question":[7],"is":[8,14,71,105,285],"whether":[9],"a":[10,26,40,121,191],"concrete":[11],"tool":[12,34,46,50,244],"call":[13,64],"authorized":[15],"before":[16],"it":[17],"executes.":[18],"We":[19,91],"describe":[20],"Agent":[22],"Security":[23],"Contract":[24],"(ASC),":[25],"deny-by-default,":[27],"pre-execution":[28],"gate":[29],"for":[30,224],"agent":[31,104],"and":[32,62,80,86,164,174,270],"MCP":[33],"calls.":[35],"An":[36],"ASC":[37,153],"policy":[38,112,133,182],"pins":[39],"SHA-256":[41],"digest":[42],"of":[43,108,138,168,185,210,218,235,250],"approved":[45],"catalog,":[47],"declares":[48],"per-agent":[49],"allowlists":[51],"with":[52,256,267],"argument":[53],"constraints,":[54],"marks":[55],"high-impact":[56],"tools":[57],"that":[58],"require":[59],"out-of-band":[60],"approval,":[61],"bounds":[63],"rates;":[65],"each":[66],"decision":[67],"(ALLOW,":[68],"BLOCK,":[69],"REQUIRE_APPROVAL)":[70],"emitted":[72],"as":[73],"an":[74],"integrity-checked":[75],"(unkeyed)":[76],"JSON":[77],"evidence":[78],"envelope,":[79],"every":[81],"error":[82],"path":[83],"we":[84,194],"enumerate":[85],"test":[87],"resolves":[88],"to":[89,130],"BLOCK.":[90],"evaluate":[92],"open-source":[94],"implementation":[95],"on":[96,120,263],"static,":[97],"recorded":[98],"tool-call":[99],"traces":[100,200,214],"only;":[101],"no":[102,268,271,279],"live":[103],"run.":[106],"Bypasses":[107],"v0.1.0":[110],"demo":[111],"found":[113],"in":[114,118,158],"review":[115],"were":[116],"fixed":[117],"v0.2.0;":[119],"60-case":[122],"adversarial":[123],"probe,":[124],"allowed":[125],"attacks":[126,171],"fall":[127],"from":[128,242],"32":[129],"1":[131],"(a":[132],"gap),":[134],"at":[135],"cost":[137],"3":[139],"new":[140],"benign":[141,220,237,254],"over-blocks.":[142],"On":[143],"author-constructed":[145],"66-scenario":[146],"v0.2.1":[147,257],"corpus,":[148],"designed":[149],"around":[150],"these":[151,230],"checks,":[152],"returns":[154],"expected":[156],"verdict":[157],"66/66":[159],"cases;":[160],"tool-name":[161],"RBAC":[162],"(Python":[163],"OPA/Rego)":[165],"admits":[166],"30":[167],"its":[169],"33":[170],"by":[172],"construction,":[173],"mutation":[175],"testing":[176],"shows":[177],"corpus":[179],"exercises":[180],"few":[181],"constraints":[183],"(8":[184],"62":[186],"single-constraint":[187],"mutants":[188],"killed).":[189],"As":[190],"held-out":[192],"check":[193],"replay":[195],"132":[196,265],"AgentDojo":[197],"v1.2":[198],"ground-truth":[199],"under":[201],"policies":[202,232],"frozen":[203],"beforehand.":[204],"With":[205],"tool-level":[206,261],"approval":[207],"policies,":[208],"25":[209],"26":[211],"non-empty":[212],"attack":[213],"but":[215],"also":[216],"60":[217],"97":[219,236],"tasks":[221],"are":[222],"held":[223],"approval.":[225],"v0.2.0's":[226,248],"strict-argument":[227],"rule":[228],"makes":[229],"unadapted":[231],"block":[233],"94":[234],"tasks.":[238],"Policies":[239],"derived":[240],"mechanically":[241],"AgentDojo's":[243],"signatures":[245],"first":[246],"hit":[247],"lack":[249],"optional":[251],"arguments":[252],"(31":[253],"blocks);":[255],"they":[258],"reproduce":[259],"verdicts":[262],"all":[264],"traces,":[266],"blocks":[269],"newly":[272],"admitted":[273],"attack,":[274],"so":[275],"type-only":[276],"declarations":[277],"add":[278],"protection":[280],"here.":[281],"Median":[282],"in-process":[283],"latency":[284],"about":[286],"38":[287],"us":[288],"per":[289],"trace.":[290]},"counts_by_year":[],"updated_date":"2026-11-11T12:16:26.678958","created_date":"2026-11-10T00:00:00"}