Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents

Summary

This paper argues that per-action authorization, where a local guard screens each tool call in isolation, cannot enforce global policies spanning intent, purpose, provenance, consent, and delegation in autonomous LLM agents. The authors prove that relational purpose violations are 2-safety hyperproperties that a per-action monitor cannot detect without false alarms, and that none of the six surveyed guardrails implements cross-execution monitoring. Using AL-SYNTH, a SAT/SMT synthesizer, they show nine LLM judges approve the synthesized witnesses almost without exception when viewed per action, yet flag them when shown the two executions together.

Related items

• MediumCVE-2026-114054: vLLM cache aliasing lets attackers collide shared cache keysSimilar attack · NVD/CVE Database
• HighCVE-2026-114053: vLLM arbitrary Python execution via mm_processor_kwargs code_revisionSimilar attack · NVD/CVE Database
• LowCVE-2026-114049: vLLM cross-request mask leak in InputBatch.condense() via /invocationsSimilar attack · NVD/CVE Database
• HighCVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro CrewSimilar attack · AWS Security Bulletins
• MediumFrom Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM UsageSimilar attack · Wiz Research Blog