Llms show unstable decisions as authorization gates in coding tools
AuthGateBench: Benchmarking LLMs as Authorization Gate
Artificial Intelligence
Summary
Automated systems sometimes let computer programs do risky actions if a language model says it’s okay, but these models can make mistakes by approving too much or blocking okay actions. The authors created a new test called AuthGateBench to see if language models really understand when to say yes or no based on the exact request rather than just the action. They found that many language models are unreliable and often say no even when the action is clearly allowed. However, including extra information about the environment helps the models decide better.
What this means in practice
- •For software development teams: Test and improve AI-based authorization checks in coding assistants to reduce incorrect blocks and unsafe approvals.
- •For security engineering teams: Evaluate how environment context can enhance large language models’ decisions to prevent unintended access in automated approval workflows.
- •For cloud platform operators: Use benchmark insights to build more reliable automatic permission systems that better distinguish authorized actions from risky ones.$Commercial implications: Enables development of commercial-grade authorization filter products that reduce manual oversight in cloud environments.
Authors
Zhixiong Zhuang, Jin Jia, Zhiwei Shang, Ziyu Wang
Abstract
Automated approval systems let coding agents execute high-risk actions with minimal human oversight by delegating the authorization decision to a classifier, typically a large language model (LLM). Such systems, adopted in tools like Claude Code and Codex, remain vulnerable to failure modes such as scope escalation, where the agent takes actions exceeding what the user authorized. Existing benchmarks focus mainly on malicious requests, evaluating refusal under an implicit policy. We introduce AuthGateBench, the first policy-guided benchmark for authorization gating under benign requests. We implement a novel pipeline where an LLM generates contrast pairs with identical action and trajectory but differing request, flipping the label between block and allow. This allows us to assess whether models reason over context rather than the action alone. We further examine whether auxiliary environment signals can help models make better decisions. The resulting benchmark comprises 1,400 instances spanning five failure modes drawn from real-world Claude Code incidents. Evaluations show accuracy degrades unevenly across failure modes as models over-rely on internal safety alignment, and models still block most actions even when explicitly authorized, revealing unstable rather than deterministic decisions; retrospectively retrieved environment signals, however, substantially improve authorization accuracy.