Authorization checks must match executed actions after reconstruction
From Approval to Execution: Reconstruction-Aware Repair Analysis for LLM-Agent Software
Software Engineering
Summary
The paper shows that when AI agents ask for permission to act, what you see for approval isn't always what the system finally executes. The authors explain how changes made behind the scenes can let unauthorized actions slip through. They created a method to analyze if the final action truly matches what was approved, catching hidden authorization bypasses. Their approach was tested and confirmed to catch issues missed by earlier techniques.
What this means in practice
- •For software security teams: Detect and fix security gaps where approved AI agent actions are altered before execution, ensuring compliance with intended permissions.
- •For enterprise automation developers: Improve reliability of AI-based automated workflows by verifying that approved commands are exactly what executes after data reconstruction steps.
Authors
Junchi Zhu, Zhenguang Liu, Shaojing Fan, Jianhai Chen, Qinming He
Abstract
Approval mechanisms have become a primary safeguard for consequential actions in LLM-agent software. Yet the action shown for approval is often not the object ultimately consumed: workflow reload, transcript projection, argument rebinding, and durable-state lookup may reconstruct it before execution. Existing fieldflow and check-coverage analyses can establish that expected fields were inspected, but not that the inspected object version reaches the sink or that no replacement intervenes between check and use. Consequently, a locally complete repair may still leave a residual authorization bypass after reconstruction. We address this problem through three designs. (1) We formulate reconstruction-stable authorization (ReSA) over representation transitions, sink dependencies, consumed versions, and grant scope. (2) We derive obligations that judge candidate repairs and expose residual sink suffixes. (3) We implement the analysis in APAS-Finder and freeze predictions before an independent sink oracle observes execution. Predictions agree with all 28 controlled outcomes. Four matched pairs require opposite judgments despite identical field-flow and check coverage; a CodeQL composite recovers all eight when supplied object flow, dominance, interference, and the same grant contract. Two analysts agree on all four model-validation dispositions and 19/20 sink dependencies. On released consumers, five repairs prevent 60/60 tested out-of-scope effects, while three mechanism contrasts expose the predicted residual effects. Repair sufficiency therefore depends on the reconstructed action consumed, not merely on an approval record or earlier checked representation.