有界智能体：多智能体AI系统的委派安全

摘要

基于大语言模型的智能体可以代表用户访问云服务、调用工具或调用其他智能体。在会话开始时，智能体的权限被设定但保持静态，每个请求被独立评估，不考虑先前的操作。在其权限范围内，智能体可能违背委派任务行事，将单独允许的操作组合成被禁止的结果，或在未加限制的情况下将权限委派给子智能体。只有当智能体拥有执行此类操作的权限时，提示注入才会构成风险；因此，这不仅是模型问题，更是授权架构问题。智能体主体链（APC）追踪从一个主体到下一个主体的权限委派。APC使用六项授权检查，根据累积的会话状态评估每个请求。APC延续并约束委派的范围和预算。通过组合闭包，APC将请求与先前的操作进行对比检查，以防止被禁止的组合，并在模型之外强制执行决策。我们证明了APC实现的爆炸半径单调性和组合健全性；组合健全性仅限于在完整限制集和串行准入条件下的被禁止组合。我们评估了包括InjecAgent、AgentDojo和ASB在内的3,154个实例。我们的模型受损评估通过在第一次合法工具调用后插入真实攻击调用，独立于模型行为测试APC。在全部四个领域中，AgentDojo的数据外泄率从75-100%降至0%；APC阻止了所有544个InjecAgent数据窃取案例。意图绑定将破坏行为从38.6%降至4.0%，将操纵行为从90.5%降至12.1%。在空闲主机上，授权延迟在第99百分位为0.24毫秒；在949对AgentDojo任务-注入组合中，两种设置下的效用分别降低了8.6和13.9个百分点。实现代码、评估工具和数据均已公开提供。

English

LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.