LLM agent workflows gain safer data control through purpose-bound authorization
DelegateGuard: Purpose-Bound Capabilities for Delegated LLM Agent Workflows
Cryptography and Security
Summary
Large language models (LLMs) that assign tasks to smaller helper agents risk leaking sensitive information or misusing their granted powers. The authors created DelegateGuard, a system that precisely controls what each delegated agent can do based on purpose, labels, and limits on actions, blocking harmful behavior like unauthorized data sharing or acting after permissions are revoked. They tested it extensively on real email data and simulated attacks, showing it cuts down information leaks while keeping tasks running smoothly and quickly. This system provides a clear way to control delegated AI agents regardless of which underlying AI model is used.
What this means in practice
- •For software engineers: Control delegated autonomous components in AI workflows by enforcing precise, revocable permissions to prevent unauthorized data leaks or misuse.
- •For enterprise security teams: Enhance data protection in AI-powered automation by embedding runtime enforcement of purpose-bound authorities on delegated agents handling sensitive workflows.
Authors
Phat T. Tran-Truong, Ha Vo, Nhut Tran, Khang Vo, Thai-Minh Truong
Abstract
\textbf{(Context)} LLM agents increasingly delegate subtasks while holding authority over sensitive data, creating confused-deputy risks: an injected delegate can exfiltrate data, amplify its authority, or act after revocation. Existing leakage benchmarks expose these failures but do not constrain the authority a delegated agent may exercise. \textbf{(Methods)} We present \system, a reference monitor that converts the initiating user's authorization into attenuable capabilities over purpose, labels, operations, sinks, and delegation depth; every data-moving action is mediated outside the LLM, and revocation cascades through the delegation graph. We formalize a trace-level safety invariant and evaluate it with an adaptive within-authority adversary and four baselines, model-action and multi-turn ecological studies, and conformance and scale checks over deterministic traces and 517{,}401 Enron emails. \textbf{(Results)} \system blocks ungranted-sink exfiltration, authority amplification, revocation replay, purpose gaming, and intra-tool label violations, and dominates static allowlists on the revocation and intra-tool cases (10/10). Two open models proposed attacker-goal actions on 42/45 and 44/45 injected traces, all blocked at execution; a 90-run multi-turn study cut leakage from 0.844 to 0.20 with full task completion, at microsecond per-decision overhead. Proposition~1 characterizes exactly where attenuation-based authorization suffices, a boundary we also reproduce empirically across four observable-sink workflows. \textbf{(Conclusion \& Significance)} Purpose-bound runtime authorization gives delegated LLM workflows a model-independent execution boundary and a precise recipe for composing it with declassification and content monitoring on externally observable sinks.