Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents

Key points

• We show that local authorization does not compose into global authorization.1
• A compositional authorization failure (CAF) is a locally authorized execution, or a pair of locally authorized executions, that violates a global policy spanning intent, purpose, provenance, consent, and delegation.1
• We characterize CAFs along two axes, expressiveness (single-trace safety versus relational k-safety) and observability (a ladder of monitor profiles).1
• Our central result is an impossibility: relational purpose violations form a 2-safety hyperproperty with no per-trace locus of blame, so a per-action monitor that never raises a false alarm detects none of them, independent of the underlying model or decision procedure; they become visible only under cross-execution monitoring, which none of the six guardrails we survey implements.1

Sources (1)

• [1]Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 20, 04:35 AM

  Autonomous LLM agents act through tools under per-action authorization: a local guard screens each tool call in isolation.

  We show that local authorization does not compose into global authorization.

Extractive summary: sentences quoted from the sources.