Authorization Architectures for Tool-Using AI Agents

arXiv:2609.15906 · cs.CR · Submitted 2026-09-14 · Read on arXiv

cs.CR

Submitted: 2026-09-14

Updated: 2026-09-14

Comments: 70 pages, 8 figures, 10 tables

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Provenance — 71× in this paper · explained in 3 episodes
• Aggregation — 22× in this paper · explained in 1 episode
• Trace — 15× in this paper · explained in 2 episodes
• Verification — 12× in this paper · explained in 2 episodes
• AI Agents — 11× in this paper · explained in 2 episodes
• Accountability — 11× in this paper · explained in 2 episodes
• Benchmark — 10× in this paper · explained in 2 episodes
• Agentic System — 8× in this paper · explained in 2 episodes
• Agentic AI — 6× in this paper · explained in 1 episode
• Action Space — 5× in this paper · explained in 1 episode
• Alignment — 5× in this paper · explained in 1 episode
• Model Context Protocol — 5× in this paper
• Archetype — 4× in this paper · explained in 1 episode
• Core — 4× in this paper · explained in 2 episodes
• Actor — 3× in this paper · explained in 3 episodes
• Artificial Intelligence (AI) — 3× in this paper · explained in 2 episodes
• Benchmarking — 3× in this paper · explained in 3 episodes
• Cloud Security Alliance — 3× in this paper
• European Union — 3× in this paper
• Failure Modes — 3× in this paper · explained in 3 episodes
• Multi-Agent System — 3× in this paper · explained in 5 episodes
• RAG — 3× in this paper · explained in 3 episodes
• Reward Hacking — 3× in this paper · explained in 8 episodes
• Verifier — 3× in this paper · explained in 2 episodes
• Abstraction — 2× in this paper · explained in 1 episode
• Agent Identity Protocol — 2× in this paper
• Agentic AI systems — 2× in this paper · explained in 1 episode
• Calibration — 2× in this paper · explained in 7 episodes
• Internet Engineering Task Force — 2× in this paper
• Model Context Protocol (MCP) — 2× in this paper · explained in 8 episodes
• National Institute of Standards and Technology — 2× in this paper
• Provenance-Centric Agentic System — 2× in this paper
• Rich Authorization Requests — 2× in this paper
• Robustness — 2× in this paper · explained in 5 episodes
• Secure Production Identity Framework for Everyone — 2× in this paper
• Selection Bias — 2× in this paper · explained in 4 episodes
• Verifiability — 2× in this paper · explained in 2 episodes
• Accuracy — 1× in this paper · explained in 1 episode
• Agentic LLM Systems — 1× in this paper · explained in 1 episode
• Agentic Workflows — 1× in this paper · explained in 1 episode
• Amazon Web Services — 1× in this paper
• Decoupling — 1× in this paper · explained in 2 episodes
• Differential Privacy — 1× in this paper · explained in 4 episodes
• Formal Methods — 1× in this paper · explained in 3 episodes
• Human Delegation Provenance — 1× in this paper
• Human-in-the-Loop — 1× in this paper · explained in 3 episodes
• Infocomm Media Development Authority — 1× in this paper
• Large Language Models (LLMs) — 1× in this paper · explained in 6 episodes
• Modular Architecture — 1× in this paper · explained in 4 episodes
• Multi-Agent Framework — 1× in this paper · explained in 3 episodes
• Multi-agent Collaboration — 1× in this paper · explained in 2 episodes
• Prompt Engineering — 1× in this paper · explained in 4 episodes
• Reinforcement Learning — 1× in this paper · explained in 4 episodes
• Semantic Gap — 1× in this paper · explained in 2 episodes

Sources

• MRKL Systems: A modular, neuro-symbolic architecture that combines large language models, external knowledge sources and discrete reasoning
• ReAct: Synergizing Reasoning and Acting in Language Models
• How are AI agents used? Evidence from 177,000 MCP tools
• A Survey of AI Agent Protocols
• Security Risks in Tool-Enabled AI Agents: A Systematic Analysis of Privileged Execution Environments
• An AI Agent Execution Environment to Safeguard User Data
• LLM Agents can Autonomously Hack Websites
• Prompt Injection attack against LLM-integrated Applications
• A Comparative Study of Software Secrets Reporting by Secret Detection Tools
• Pushed by Accident: A Mixed-Methods Study on Strategies of Handling Secret Information in Source Code Repositories
• A Comprehensive Formal Security Analysis of OAuth 2.0
• The Web SSO Standard OpenID Connect: In-Depth Formal Security Analysis and Security Guidelines
• Self-Sovereign Identity: A Systematic Review, Mapping and Taxonomy
• Zero Trust Architecture: A Systematic Literature Review
• Authenticated Delegation and Authorized AI Agents
• Authorization Propagation in Multi-Agent AI Systems: Identity Governance as Infrastructure
• Intelligent AI Delegation
• AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A
• AgenTRIM: Tool Risk Mitigation for Agentic AI
• AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills
• Token Composition: A Graph Based on EVM Logs