Intent-Governed Tool Authorization for AI Agents

研究概览

一个集成可能合理地拥有较宽的长期权限，但用户当前提出的请求往往很窄。如果用户只要求生成摘要，智能体不应仅仅因为集成拥有相关作用域，就同时取得导出或删除数据的权限。

意图治理访问控制会把受信任的用户请求转化为可审计的意图证书，据此收窄当前会话可见的工具，并检查所选工具、请求载荷、目标资源和预期效果是否仍处于证书边界之内。面对含糊、低置信度或高风险请求，系统可以拒绝执行、要求澄清，或将其交给 OpenPort 的草稿与 preflight 审查路径。

英文摘要

AI agents increasingly act through external tools: they read private data, construct structured payloads, submit write requests, export records, and coordinate workflows across application boundaries. Existing authorization mechanisms usually ask whether an integration credential, app, or token can call a tool. That question is necessary but incomplete. A tool call can be authorized by static credentials and still be unjustified by the user’s current request. For example, a credential that can read and export records should not expose export authority when the user only asked for a bounded summary, and a model-generated delete call should not execute merely because the integration has a delete scope. This paper proposes Intent-Governed Access Control (IGAC), a server-side authorization layer that treats the user’s expressed intent as a monotone, auditable policy attribute for AI-agent tool use. IGAC introduces intent certificates, session-scoped policy narrowing, intent-aware manifest filtering, and intent-tool-payload consistency checks. The central invariant is that user intent may only reduce the authority granted by static integration policy; it never expands scopes, data policy, tenant boundaries, or review requirements. We map IGAC onto OpenPort, an existing governance substrate that already implements authorization-dependent discovery, scope and ABAC-style policy checks, draft-first writes, preflight impact binding, state-witness checks, idempotency, stable reason codes, and audit. The current artifact includes a minimal reusable IGAC runtime path in OpenPort: an intent endpoint, in-memory certificate store, intent-aware manifest endpoint, intent-bound action/preflight checks, reason-code failures, and audit binding. We therefore present a formal model, security analysis, implementation mapping, executable synthetic checks, a runtime-backed microbenchmark, an expanded real-LLM pilot, a scored end-to-end LLM-in-the-loop runtime benchmark over the actual OpenPort path, and a benchmark-shaped external-subset runtime pilot. The deterministic checks validate internal policy invariants, while the provider-backed LLM studies provide preliminary runtime-path evidence of unsafe-execution containment and help characterize the remaining unsafe-accepted-authority surface. The paper positions intent as a missing access-control primitive between natural-language user requests and enforceable tool effects.

核心贡献

1. 01

   问题定义

   将“意图与工具不匹配”定义为一种访问控制失效：某次调用可能得到静态凭证许可，却没有得到用户当前明确请求的支持。

2. 02

   形式化模型

   定义意图证书、单调收窄的会话策略、感知意图的 manifest、资源及效果边界、一致性判定和可审计的执行记录。

3. 03

   服务端设计

   在不把模型、规划器或意图分类器视为最终安全主体的前提下，过滤可见工具，并检查工具、载荷、资源与执行效果的一致性。

4. 04

   最小可复用实现

   将 IGAC 映射到 OpenPort，实现证书创建、感知意图的 manifest、action 与 preflight 检查、稳定拒绝原因、生命周期隔离和审计绑定。

5. 05

   分阶段初步评估

   提供确定性检查、由真实运行时支撑的合成微基准、真实 LLM 试验和小规模端到端运行时研究。这些证据支持机制层面的结论，不支持部署层面的安全效果宣称。

IGAC 如何建立在 OpenPort 之上

OpenPort 回答：“在既有策略下，这个集成是否可以产生该执行效果？”IGAC 进一步回答：“用户当前提出的请求是否足以授权这一效果？”

OpenPort 是下游的执行效果控制层；IGAC 是上游的意图控制层。它先收窄可见工具与允许的执行效果，再把符合边界的调用交给 OpenPort 的受治理执行路径。IGAC 无法授予任何被 OpenPort 或底层授权体系拒绝的权限。

1. 01用户意图
2. 02动态最小权限
3. 03经过筛选的工具
4. 04受治理的执行效果

引用本文

建议使用 DOI 作为稳定引用。下方 BibTeX 记录对应本页面标注的 arXiv 版本。

Zhu, G., & Wang, C. (2026). Intent-Governed Tool Authorization for AI Agents [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2606.22916

@misc{zhu2026igac,
  title         = {{Intent-Governed Tool Authorization for AI Agents}},
  author        = {Zhu, Genliang and Wang, Chu},
  year          = {2026},
  month         = jun,
  eprint        = {2606.22916},
  archivePrefix = {arXiv},
  primaryClass  = {cs.AI},
  doi           = {10.48550/arXiv.2606.22916},
  url           = {https://arxiv.org/abs/2606.22916},
  note          = {arXiv:2606.22916v1}
}