Intent-Governed Tool Authorization for AI Agents

研究概覽

一個整合可能合理地擁有較寬的長期權限，但使用者目前提出的請求往往很窄。如果使用者只要求產生摘要，智能體不應僅因整合擁有相關作用域，就同時取得匯出或刪除資料的權限。

意圖治理存取控制會把受信任的使用者請求轉化為可稽核的意圖憑證，據此收窄目前工作階段可見的工具，並檢查所選工具、請求酬載、目標資源及預期效果是否仍處於憑證邊界之內。面對含糊、低信心或高風險請求，系統可以拒絕執行、要求釐清，或將其交給 OpenPort 的草稿與 preflight 審查路徑。

英文摘要

AI agents increasingly act through external tools: they read private data, construct structured payloads, submit write requests, export records, and coordinate workflows across application boundaries. Existing authorization mechanisms usually ask whether an integration credential, app, or token can call a tool. That question is necessary but incomplete. A tool call can be authorized by static credentials and still be unjustified by the user’s current request. For example, a credential that can read and export records should not expose export authority when the user only asked for a bounded summary, and a model-generated delete call should not execute merely because the integration has a delete scope. This paper proposes Intent-Governed Access Control (IGAC), a server-side authorization layer that treats the user’s expressed intent as a monotone, auditable policy attribute for AI-agent tool use. IGAC introduces intent certificates, session-scoped policy narrowing, intent-aware manifest filtering, and intent-tool-payload consistency checks. The central invariant is that user intent may only reduce the authority granted by static integration policy; it never expands scopes, data policy, tenant boundaries, or review requirements. We map IGAC onto OpenPort, an existing governance substrate that already implements authorization-dependent discovery, scope and ABAC-style policy checks, draft-first writes, preflight impact binding, state-witness checks, idempotency, stable reason codes, and audit. The current artifact includes a minimal reusable IGAC runtime path in OpenPort: an intent endpoint, in-memory certificate store, intent-aware manifest endpoint, intent-bound action/preflight checks, reason-code failures, and audit binding. We therefore present a formal model, security analysis, implementation mapping, executable synthetic checks, a runtime-backed microbenchmark, an expanded real-LLM pilot, a scored end-to-end LLM-in-the-loop runtime benchmark over the actual OpenPort path, and a benchmark-shaped external-subset runtime pilot. The deterministic checks validate internal policy invariants, while the provider-backed LLM studies provide preliminary runtime-path evidence of unsafe-execution containment and help characterize the remaining unsafe-accepted-authority surface. The paper positions intent as a missing access-control primitive between natural-language user requests and enforceable tool effects.

核心貢獻

1. 01

   問題定義

   將「意圖與工具不相符」定義為一種存取控制失效：某次呼叫可能得到靜態憑證許可，卻沒有得到使用者目前明確請求的支持。

2. 02

   形式化模型

   定義意圖憑證、單調收窄的工作階段策略、感知意圖的 manifest、資源及效果邊界、一致性判定和可稽核的執行記錄。

3. 03

   服務端設計

   在不把模型、規劃器或意圖分類器視為最終安全主體的前提下，過濾可見工具，並檢查工具、酬載、資源與執行效果的一致性。

4. 04

   最小可重用實作

   將 IGAC 映射到 OpenPort，實作憑證建立、感知意圖的 manifest、action 與 preflight 檢查、穩定拒絕原因、生命週期隔離和稽核綁定。

5. 05

   分階段初步評估

   提供確定性檢查、由真實執行環境支撐的合成微基準、真實 LLM 試驗及小規模端到端執行環境研究。這些證據支持機制層面的結論，不支持部署層面的安全效果宣稱。

IGAC 如何建立在 OpenPort 之上

OpenPort 回答：「在既有策略下，這個整合是否可以產生該執行效果？」IGAC 進一步回答：「使用者目前提出的請求是否足以授權這項效果？」

OpenPort 是下游的執行效果控制層；IGAC 是上游的意圖控制層。它先收窄可見工具與允許的執行效果，再把符合邊界的呼叫交給 OpenPort 的受治理執行路徑。IGAC 無法授予任何被 OpenPort 或底層授權體系拒絕的權限。

1. 01使用者意圖
2. 02動態最小權限
3. 03經過篩選的工具
4. 04受治理的執行效果

引用本文

建議使用 DOI 作為穩定引用。下方 BibTeX 記錄對應本頁面標示的 arXiv 版本。

Zhu, G., & Wang, C. (2026). Intent-Governed Tool Authorization for AI Agents [Preprint]. arXiv. https://doi.org/10.48550/arXiv.2606.22916

@misc{zhu2026igac,
  title         = {{Intent-Governed Tool Authorization for AI Agents}},
  author        = {Zhu, Genliang and Wang, Chu},
  year          = {2026},
  month         = jun,
  eprint        = {2606.22916},
  archivePrefix = {arXiv},
  primaryClass  = {cs.AI},
  doi           = {10.48550/arXiv.2606.22916},
  url           = {https://arxiv.org/abs/2606.22916},
  note          = {arXiv:2606.22916v1}
}