LLM agents gain safer task-based control over actions and access
LLM Agent Capabilities Should Follow Task Intent and Context Source
Cryptography and SecurityOperating Systems
Summary
Large language model (LLM) agents can perform many actions like running code or editing files, but letting them do everything all the time can be risky. The authors show that the agent’s allowed actions should depend on what the agent intends to do, based on different context sources such as user requests and tool instructions. They introduce IntentCap, a system that combines these sources to create precise, temporary permissions for each task, ensuring that agents only get the access they need and nothing more. This approach helps prevent bad or accidental commands from causing harm while letting agents work effectively.
What this means in practice
- •For software development teams: Implement fine-grained, intent-aware permission controls for automated LLM agents executing code or modifying files in development environments.
- •For cloud service operators: Improve safety by dynamically limiting LLM agent capabilities based on task intent when delegating tasks across distributed services.
Authors
Yusheng Zheng, Wenhui Zhang, Yu Mao
Abstract
LLM agents take real actions, including executing code, modifying files, calling services, and delegating tasks, driven by context sources: user requests, tool results, documents, shell outputs, Skill and MCP instructions, memory. Unlike traditional systems, where capability is predefined, the least-privilege capability an agent needs is dynamic, depending on its task intent: what it wants to do and how. This creates a security and safety challenge: all inputs enter one shared planning channel with equal influence, by adversarial injection or accidental scope widening, yet a user's explicit request and a document's extracted text carry different trust and should not share authority to choose a destination or widen access. Existing defenses constrain operations and information flow; we study task-scoped, multi-source authority composition. We argue that agent capabilities should be scoped to the current task intent, not a sandbox or session lifetime, and that no single context source defines a complete capability. IntentCap composes capabilities from four such sources: user intent, workflow instructions, tool schemas, and runtime environment, with field-level ownership and monotonic narrowing. Each source contributes specific fields, none can fill another's, and the lease only narrows the user's authorized authority, never widens it. IntentCap uses an LLM to generate short-lived leases from these sources, validated by a deterministic checker before any side effect commits and enforced by tool- and OS-level information flow policies. Evaluation shows IntentCap blocks tested violations without rejecting benign actions, each source boundary is independently necessary, and the checker generalizes across tool, execution, placement, and delegation boundaries.