Aletheia: Permission-Minimality Testing for Coding-Agent Rules

arXiv:2609.39678 · cs.CR, cs.SE · Submitted 2026-09-30 · Read on arXiv

Listen

Radio episode about this paper

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "Aletheia: Permission-Minimality Testing for Coding-Agent Rules".

Elias: Aletheia introduces a framework for permission-minimality testing that translates requested authority into a typed language to synthesize executable sandbox configurations,

Nadia: First, who's behind it and why it matters.

Paper summary: Nadia: So, to recap, Aletheia is a framework that translates requested authority into a typed language to synthesize executable sandbox configurations. The central claim of the paper is that this allows researchers to diagnose suspicious requests by verifying functional correctness when one permission is removed while keeping the original rule in place. This addresses the gap where just checking if something works doesn't reveal malicious intent from coding agents exploiting repository instructions for indirect prompt injection.

Elias: And I’d add that the method formalizes synthesis and connects witnesses to enforced restrictions. The gist is that you set up a rule R, a project W, a task q, and independent tests T. You then check if the agent completes the task under full permissions versus when one permission is removed independently. Passing functional tests in this reduced authority provides a witness for dispensability against the original rule.

Priya: From my perspective, what matters is that they are formalizing exactly how those witnesses connect to restrictions, which means we have a structured way to interpret whether an agent's behavior under reduced constraints is truly indicative of a security issue or just expected variability. It sounds like they’re building the machinery to formally link source requests to enforceable limitations while preserving the original functionality.

Nadia: Precisely, Priya; they are using this approach to ensure that when we suspect something suspicious, we have verifiable evidence based on whether the agent still functions correctly under strictly reduced authority. The framework is designed to connect those source requests directly to enforceable restrictions in a way that's traceable.

Elias: And the technical core involves separating requested authority from task execution using a SystemDSL, which defines resource types like filesystem and network, and then ensuring that the type system enforces constraints before anything else happens. This ensures things like a network endpoint cannot be used as the target for a filesystem read operation.

Priya: That reliance on the type system to constrain possibilities upfront sounds like it’s doing a lot of the heavy lifting in terms of preventing nonsensical operations from ever being considered, which is useful when we are trying to measure what's actually happening in resource usage.

Nadia: It also involves configuration synthesis using a formula that results in the least dependency-closed set containing the baseline authority plus elaborated grants, which is then lowered to a runnable configuration. This process makes sure that what we run is based on the most minimal necessary authority derived from all those inputs.

Elias: And then they evaluate this against independent executions where each permission p is removed one by one, looking for the witness condition which requires both accepted artifacts and a strict authority reduction. This rigorous comparison ensures that any proposed restriction is actually dispensable and doesn't just appear to be so because of how we set it up.

Priya: So, if they find that the witness holds across multiple independent tests T, it means the reduction in authority didn't negatively affect the outcome of what we’re measuring, which gives us concrete data on what is truly dispensable. That moves us closer to understanding agent behavior under different operational settings.

Nadia: Exactly; if that condition is met, Aletheia interprets it against the task context to diagnose suspicious requests by verifying functional correctness under strictly reduced authority. It’s a mechanism for diagnosing those tricky indirect prompt injections where the agent might produce a correct patch despite requesting something unauthorized.

Conclusion: Nadia: So, looking at "Aletheia: Permission-Minimality Testing for Coding-Agent Rules," the core value lies in how it operationalizes the concept of permission minimality testing for coding agents. The authors, Jieke Shi and colleagues, developed a framework that translates authority into a typed language to synthesize configurations and test them against independent functional tests.

Elias: And they proved that this structured approach allows us to diagnose suspicious requests by checking functional correctness under reduced authority without needing to assume malicious intent beforehand. The implication is that we gain a rigorous method for verifying agent behavior by establishing dispensability witnesses through execution evidence, which moves beyond just looking at the final output.

Priya: From a broader view, this suggests that we are developing methods to quantify when an operation is truly necessary versus when it’s just surplus permission, which is important because it helps us measure risk exposure in agent systems by distinguishing between required and optional actions.

Nadia: Exactly, Priya; the paper demonstrates that even exercised authority can be withdrawn if the task context allows for it. The main point is that this framework provides a way to connect source requests to enforceable restrictions while preserving tested functionality, giving us evidence without needing an established classification gain.

Elias: It’s about moving from a purely theoretical model to one that involves concrete synthesis of configurations and actual testing against those synthesized settings, which gives researchers a tangible tool for probing how these agents handle authority in practice.

Priya: I think the future work mentioned in the paper points toward evaluating repository-specific tasks and strengthening translation and oracle validation, which is where we can really start applying this framework to specific agent workflows. It seems like they're setting up for a more practical application where we can test these ideas on real coding agent instructions.

Nadia: That’s right; the implication is that individual, task-relative restrictions are feasible and that the paper paves the way for more granular control over how AI interacts with its environment based on context. It sets up a path for testing these ideas in a more applied setting.

JIEKE SHI, YUCHEN CHEN, JUNDA HE, YUE LIU, DAVID LO

Singapore Management University · Nanjing University · Adelaide University

cs.CR, cs.SE

Submitted: 2026-09-30

Updated: 2026-09-30

Comments: 6 pages, 1 figure, 1 table, 1 algorithm

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 92/100

The gist: Aletheia introduces a framework for permission-minimality testing that translates requested authority into a typed language to synthesize executable sandbox configurations, allowing researchers to

Key concepts

Permission-Minimality Testing Framework
This core idea tests if an agent can still finish a task when one specific permission is withheld. It formalizes how to check if removing a single permission breaks the agent's ability to perform the required action, using independent functional tests as proof.
SystemDSL
A specialized language used to separate what the agent *requests* (authority) from what it *does* (task execution). It defines resource types like filesystem or network and ensures that certain operations are logically impossible, such as a network endpoint being used for file reading.
Witness Condition
This condition determines if removing a permission is effective. A witness is established if the agent can still pass tests even without the permission, but only if its ability to perform the task drops strictly when that specific permission is removed.

Terminology

Summary

Aletheia introduces a framework for permission-minimality testing that translates requested authority into a typed language to synthesize executable sandbox configurations, allowing researchers to diagnose suspicious requests by verifying functional correctness under strictly reduced authority. This approach addresses the gap where functional correctness alone does not reveal malicious intent in coding agents that can exploit repository instructions for indirect prompt injection.

The gist

Aletheia translates requested authority into a typed language and synthesizes executable sandbox configurations, running the unchanged rule and task under full permissions and independent restrictions that remove one permission at a time, where passing independent functional tests under strictly reduced authority provides a dispensability witness.

Permission-Minimality Testing Framework

The core idea is to test whether an agent can complete an independently specified task when a requested permission is withheld, while retaining the original rule. The process involves setting up the inputs: a rule R, an initial project W, a task request q, and independently supplied tests T. The framework formalizes synthesis and the conditions connecting witnesses to enforced restrictions.

The comparison requires addressing two challenges: Permissions overlap and share dependencies, such as deleting a file grant is ineffective if another covers its directory, while ensuring that surviving tools must retain shared dependencies. Acceptance must come from trusted tests, as an attacker can claim unwanted operations are mandatory, and executions must restore the same initial state. Aletheia combines typed extraction, dependency-aware synthesis, and independent deletion experiments to connect source requests to enforceable restrictions preserving tested functionality.

Permission Language and Extraction

The system separates requested authority from task execution using a SystemDSL. This DSL defines core fragments for rule blocks:

**d::= extern r: ρ rule s from x span(i, j) **

The language includes resource types such as filesystem, network, tool, and sandbox. The type system ensures that a network endpoint cannot serve as the target of fs.read. Grant checking is formalized by:

Γ ⊢ allow a(e): grant.

Configuration Synthesis

Resource binding precedes permission deletion. Trusted bindings resolve resource names to concrete paths, tools, and endpoints. Preparation fixes a manifest M containing the runtime, backend, resource bindings β, baseline authority B, dependencies, and initial project and fixture state S0.

Synthesis computes the resulting configuration using the formula:

clM (X) = muZ.X ∪ [b a ∈ Z, a →M b]

This results in the least dependency-closed set containing baseline authority plus the elaborated grants. The backend lowers this to a runnable configuration CM(Q), and Faithful realization requires AM(Q) = γM (EM(Q)). This ensures that Aletheia compares compiled policy coverage, with separate probes assessing selected installed restrictions.

Independent Execution and Witnesses

For each permission p in the set P, Aletheia synthesizes CM(P - p) independently. The witness condition is defined as:

WitnessT (p) ⇐⇒ AcceptT (e) ∧ AcceptT (e−p) ∧ AM(P - p) ⊊ AM(P).

This strict inclusion rejects ineffective deletions. A witness establishes an accepted artifact produced without authority in Δp, where Δp = AM(P) - AM(P - p). The algorithm ensures that Each restriction uses the original P, fixed M, and restored S0. The framework demonstrates that Neither an upload attempt nor identical patches are required for a witness to be established.

Evaluation

The framework was evaluated against 314 AIShellJack attack prefixes and five benign templates, plus 80 manually verified benign GHAgentFiles instructions. The results showed that All 314 attack inputs complete execution and are detected (100%), with no alarms on the five templates. Furthermore, GHAgentFiles produced three false positives (3.75%) and identified 26 ineffective deletions. The study concludes that execution supplies tested authority-removal evidence without an established classification gain, as legitimate operations can also be dispensable.

Related Work and Conclusion

Aletheia connects independently tested artifacts to concrete permission removal while retaining the original rule. It differs from sandbox mining by testing whether even exercised authority can be withdrawn. Future work plans include evaluating repository-specific tasks and strengthening translation, enforcement, and oracle validation. The framework supports individual, task-relative restrictions.

References

[1] Guillaume Cardoen, Tom Mens, and Alexandre Decan. 2026. GHAgentFiles: A dataset of coding agent file histories in GitHub repositories. Dataset. https://doi.org/10.5281/zenodo.

Improvements for AI systems

Here are specific improvements to current AI systems based on the Aletheia framework, and what these improved systems can achieve:

  1. Replacement of Static Privilege Models with Dynamic, Executable Dispensability Witnesses:

  2. Enhanced Security Against Indirect Prompt Injection (PI) in Agent Rules:

  3. Automated Identification of Unnecessary or Overly Broad Authority Requests During Code Generation/Refactoring:

  4. Verification of Least Privilege Compliance During Complex Tool-Use Operations:

  5. This improved system can perform a Dispensability Audit on any agent rule or instruction set before execution, determining if a requested permission (e.g., file upload, network access) is strictly necessary for the task's functional success.

  6. It can detect malicious rules that request high-level privileges (like credential access or data exfiltration) while simultaneously producing a correct patch, by checking if the agent can complete the task under reduced authority without failing its functional tests.

  7. The system will automatically generate a Witness Report for any rule execution, providing formal proof that an accepted artifact was produced without the specific permission that was tested for dispensability. This report links the specific request to the successful outcome and identifies redundant or unnecessary permissions.

  8. It can proactively flag complex, overlapping permission requests (e.g., a directory deletion grant versus a file deletion grant) as potential configuration errors or ineffective requests, preventing agents from synthesizing overly permissive configurations that might inadvertently expose sensitive resources.

  9. For tool-calling agents, it can verify that the required communication permissions (e.g., specific network endpoints) are only granted for the duration and context of the required operation, ensuring that a legitimate refactoring task doesn't accidentally establish persistent or unauthorized external connections.

Abstract

Repository instruction files guide coding agents, but also expose them to prompt injection. Malicious rules can request credential access or data transfer while the agent produces a correct patch. We present Aletheia, a framework for permission-minimality testing. Aletheia translates requested authority into a typed language and synthesizes executable sandbox configurations. It runs the unchanged rule and task under full permissions and independent restrictions that remove one permission at a time. Passing independent functional tests under strictly reduced authority provides a dispensability witness, which Aletheia interprets against task context to diagnose suspicious requests. We formalize synthesis and the conditions connecting witnesses to enforced restrictions. On a shared refactoring task, Aletheia executes and detects all 314 AIShellJack attack inputs, with no alarms on five benign templates. Among 80 manually verified benign GHAgentFiles rules, it raises three false positives (3.75%).

Sources

Related papers