CoChat
Sign Up
PreprintCited by 1Access Control and TrustUser Authentication and Security SystemsAdvanced Authentication Protocols Security

Delegated Authorization for Agents Constrained to Semantic Task-to-Scope Matching

Open access
Helou, Majed El, Troiani, Chiara, Ryder, Benjamin, Diaconu, Jean, Muyal, Hervé, Yannuzzi, Marcelo·2025·arXiv
DOI 10.48550/arxiv.2510.26702arXiv 2510.26702
Open this paper in CoChat — free accountOpen PDF

Abstract

Authorizing Large Language Model driven agents to dynamically invoke tools and access protected resources introduces significant risks, since current methods for delegating authorization grant overly broad permissions and give access to tools allowing agents to operate beyond the intended task scope. We introduce and assess a delegated authorization model enabling authorization servers to semantically inspect access requests to protected resources, and issue access tokens constrained to the minimal set of scopes necessary for the agents' assigned tasks. Given the unavailability of datasets centered on delegated authorization flows, particularly including both semantically appropriate and inappropriate scope requests for a given task, we introduce ASTRA, a dataset and data generation pipeline for benchmarking semantic matching between tasks and scopes. Our experiments show both the potential and current limitations of model-based matching, particularly as the number of scopes needed for task completion increases. Our results highlight the need for further research into semantic matching techniques enabling intent-aware authorization for multi-agent and tool-augmented applications, including fine-grained control, such as Task-Based Access Control (TBAC).

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2510.26702

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • ASTRA introduces task-based access control with semantic scope matching at authorization time but does not verify intent preservation throughout the chain.

    “ASTRA [26] introduces task-based access control with semantic scope matching at authorization time but does not verify intent preservation throughout the chain.”

    From SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems (2026) · cites this paper as [26]

    The Introduction describes semantic matching of an agent’s requested scopes against the original task at authorization time, and Appendix B places that check before token issuance. But the Abstract and Conclusion identify ASTRA as the dataset and generation pipeline used to evaluate this approach, not the access-control model itself. The described flow does not show verification of intent throughout subsequent execution. (LLM, conf=0.85)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 21

  1. T. B. Brown, B. Mann, N. Ryder, M. Subbiah, J. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, S. Agarwal, A. Herbert-Voss, G. Krueger, T. Henighan, R. Child, A. Ramesh, D. M. Ziegler, J. Wu, C. Winter, C. Hesse, M. Chen, E. Sigler, M. Litwin, S. Gray, B. Chess, J. Clark, C. Berner, S. McCandlish, A. Radford, I. Sutskever, and D. Amodei, "Language models are few-shot learners," 2020. [Online]. Available: https://arxiv.org/abs/2005.14165 · arXiv
  2. S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao, "ReAct: Synergizing reasoning and acting in language models," 2023. [Online]. Available: https://arxiv.org/abs/2210.03629 · arXiv
  3. T. Schick, J. Dwivedi-Yu, R. Dessì, R. Raileanu, M. Lomeli, L. Zettlemoyer, N. Cancedda, and T. Scialom, "Toolformer: Language models can teach themselves to use tools," 2023. [Online]. Available: https://arxiv.org/abs/2302.04761 · arXiv
  4. L. Wang, W. Xu, Y. Lan, Z. Hu, Y. Lan, R. K.-W. Lee, and E.-P. Lim, "Plan-and-solve prompting: Improving zero-shot chain-of-thought reasoning by large language models," 2023. [Online]. Available: https://arxiv.org/abs/2305.04091 · arXiv
  5. B. Xu, Z. Peng, B. Lei, S. Mukherjee, Y. Liu, and D. Xu, "ReWOO: Decoupling reasoning from observations for efficient augmented language models," 2023. [Online]. Available: https: //arxiv.org/abs/2305.18323
  6. X. Liu, H. Yu, H. Zhang, Y. Xu, X. Lei, H. Lai, Y. Gu, H. Ding, K. Men, K. Yang, S. Zhang, X. Deng, A. Zeng, Z. Du, C. Zhang, S. Shen, T. Zhang, Y. Su, H. Sun, M. Huang, Y. Dong, and J. Tang, "AgentBench: Evaluating LLMs as agents," 2025. [Online]. Available: https://arxiv.org/abs/2308.03688 · arXiv
  7. Y. Zhuang, Y. Yu, K. Wang, H. Sun, and C. Zhang, "ToolQA: A dataset for LLM question answering with external tools," Advances in Neural Information Processing Systems, vol. 36, pp. 50 117-50 143, 2023.
  8. G. Mialon, C. Fourrier, C. Swift, T. Wolf, Y. LeCun, and T. Scialom, "GAIA: a benchmark for general AI assistants," arXiv e-prints, pp. arXiv-2311, 2023.
  9. A. Zeng, M. Liu, R. Lu, B. Wang, X. Liu, Y. Dong, and J. Tang, "Agent- Tuning: Enabling generalized agent abilities for LLMs," in Findings of the Association for Computational Linguistics ACL, 2024, pp. 3053- 3077.
  10. X. Liu, H. Yu, H. Zhang, Y. Xu, X. Lei, H. Lai, Y. Gu, H. Ding, K. Men, K. Yang et al., "AgentBench: Evaluating LLMs as agents," arXiv e- prints, pp. arXiv-2308, 2023.
  11. K. Basu, I. Abdelaziz, S. Chaudhury, S. Dan, M. Crouse, A. Munawar, S. Kumaravel, V. Muthusamy, P. Kapanipathi, and L. A. Lastras, "API- Blend: A comprehensive corpora for training and benchmarking API LLMs, 2024," URL https://arxiv. org/abs/2402.15491.
  12. Z. Guo, A. M. Soria, W. Sun, Y. Shen, and R. Panda, "API Pack: A massive multi-programming language dataset for API call generation," arXiv preprint arXiv:2402.09615, 2024. · arXiv
  13. S. G. Patil, T. Zhang, X. Wang, and J. E. Gonzalez, "Gorilla: Large Language Model Connected with Massive APIs," arXiv preprint arXiv:2305.15334, 2023. · arXiv
  14. S. Arcadinho, D. Aparício, and M. Almeida, "Automated test generation to evaluate tool-augmented LLMs as conversational AI agents," arXiv preprint arXiv:2409.15934, 2024. · arXiv
  15. Z. Xu, A. M. Soria, S. Tan, A. Roy, A. S. Agrawal, R. Poovendran, and R. Panda, "Toucan: Synthesizing 1.5 M tool-agentic data from real- world MCP environments," arXiv preprint arXiv:2510.01179, 2025. · arXiv
  16. H. Zhang, Y. Zhang, L.-M. Zhan, J. Chen, G. Shi, A. Y. S. Lam, and X.- M. Wu, "Effectiveness of pre-training for few-shot intent classification," 2024. [Online]. Available: https://arxiv.org/abs/2109.05782 · arXiv
  17. T. Zhang, A. Norouzian, A. Mohan, and F. Ducatelle, "A new approach for fine-tuning sentence transformers for intent classification and out-of-scope detection tasks," 2024. [Online]. Available: https: //arxiv.org/abs/2410.13649
  18. G. Arora, S. Jain, and S. Merugu, "Intent detection in the age of LLMs," 2024. [Online]. Available: https://arxiv.org/abs/2410.01627 · arXiv
  19. R. Pang, S. Joglekar, B. O'Neill et al., "Zanzibar: Google's consistent, global authorization system," in USENIX Annual Technical Conference (USENIX ATC), Renton, WA, 2019.
  20. X. Fei, X. Zheng, and H. Feng, "MCP-Zero: Active Tool Discovery for Autonomous LLM Agents," 2025. [Online]. Available: https: //arxiv.org/abs/2506.01056
  21. OpenAI, "GPT-4 Technical Report," 2024. [Online]. Available: https://arxiv.org/abs/2303.08774 · arXiv

Cited by

Sorted by citations

Authors
Helou, M. E., Troiani, C., Ryder, B., Diaconu, J., Muyal, H., & Yannuzzi, M.
Affiliations
Cisco Systems (China) (CN)
Venue
arXiv
Publisher
arXiv
Published
2025
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2510.26702
arXiv
2510.26702
OpenAlex
W7103168523
Cited by
0
References
0
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by-nc-sa)
  • arXiv (Cornell University)
Funders
Cisco Systems
Topics
  • Social Sciences › Sociology and Political Science › Access Control and Trust
  • Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
  • Physical Sciences › Computer Science › Computer Networks and Communications › Advanced Authentication Protocols Security
Keywords
LLM agents, data generation pipeline, multi-agent systems, fine-grained access control

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review