PRISM: Causal Counterfactual Minimization of Agent Tool Privileges via Information Bottleneck Role Induction

Summary

The paper introduces PRISM, a method that treats LLM agents as the object of role engineering to reduce over-authorization of tools exposed through the Model Context Protocol (MCP). PRISM learns a counterfactual necessity model from sandbox interventions, compresses trajectories with an information bottleneck, and prunes roles via a bilevel Stackelberg game sampled by a generative flow network. On AgentDojo, $τ$-bench and ToolEmu it cuts authorized tools per role by 78.3%, reaches a 78.2% task success rate and 88.7% counterfactual necessity accuracy, and lowers blast radius to 15.9%.

Topics

• Model Context Protocol