{"data":{"id":"8b993269-b046-4901-8293-e035635885f4","title":"Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents","summary":"This paper argues that per-action authorization, where a local guard screens each tool call in isolation, cannot enforce global policies spanning intent, purpose, provenance, consent, and delegation in autonomous LLM agents. The authors prove that relational purpose violations are 2-safety hyperproperties that a per-action monitor cannot detect without false alarms, and that none of the six surveyed guardrails implements cross-execution monitoring. Using AL-SYNTH, a SAT/SMT synthesizer, they show nine LLM judges approve the synthesized witnesses almost without exception when viewed per action, yet flag them when shown the two executions together.","solution":"N/A -- no mitigation discussed in source.","labels":["security","research"],"sourceUrl":"https://arxiv.org/abs/2610.27620v1","publishedAt":"2026-10-20T04:35:39.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["other"],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":[],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-20T04:35:39.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity","safety"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.93,"researchCategory":"preprint","atlasIds":null}}