Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents
This paper introduces the Open Agent Passport (OAP), a deterministic, policy-based framework that intercepts and authorizes autonomous AI tool calls before execution to prevent unauthorized actions, demonstrating 100% defense against social engineering attacks in adversarial testing while maintaining low latency.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
The Big Problem: AI Agents Have Keys, But No Bouncers
Imagine you hire a super-smart robot assistant (an AI Agent) to run your business. You give this robot a master key to your office, your bank account, and your email.
- The Current Situation: You tell the robot, "Be careful and don't do anything bad." You hope its training (its "alignment") makes it smart enough to know better.
- The Reality: If a hacker whispers a clever trick into the robot's ear (a "prompt injection"), the robot might get confused. It might think, "Oh, the boss said to send $50,000 to this stranger!" and it just does it.
The paper argues that hope is not a security strategy. Just because the robot thinks it's doing the right thing doesn't mean it is doing the right thing. We need a system that checks every single action before the robot actually does it, regardless of what the robot is thinking.
The Solution: The "Open Agent Passport" (OAP)
The authors propose a new system called OAP. Think of it as a digital bouncer or a security checkpoint that stands between the robot and the real world.
Here is how it works, using a Bank Vault analogy:
- The Robot (The Agent): Wants to open a safe and take out money.
- The Old Way: The robot just walks up to the safe. If it looks confident, the safe opens. (This is dangerous).
- The OAP Way:
- Before the robot can touch the safe, it must stop at a Checkpoint.
- The robot shows its Passport (a digital ID card that says exactly what it is allowed to do).
- The Checkpoint looks at the robot's request: "You want to take out $50,000?"
- The Checkpoint looks at the Passport: "Your passport says you can only take out $500 per day."
- The Decision: The Checkpoint slams the door shut. "Denied."
- The Result: The robot never even gets to the safe. The action is blocked before it happens.
Why This is Different from Other Safety Methods
The paper compares three different ways to keep AI safe, using a House Security analogy:
| Method | The Analogy | What it Does | What it Misses |
| :--- | :--- | :--- | : |
| Model Alignment (Training) | Teaching the dog not to bite. | You train the robot to be nice. | If the dog is tricked by a stranger, it might still bite. It's not 100% reliable. |
| Sandboxed Execution (The Cage) | Putting the dog in a glass cage. | If the dog bites, it can only bite the glass. It can't hurt the people outside. | The dog can still break things inside the cage. It doesn't stop the dog from trying to bite. |
| Pre-Action Authorization (OAP) | A security guard at the door. | The guard checks the dog's ID and the visitor's ID before they enter. If the rules aren't met, the door stays locked. | It doesn't stop the dog from thinking about biting, but it stops the bite from happening. |
The Key Insight: You need all three. But the paper argues that the "Security Guard" (Pre-Action Authorization) is the missing piece that current systems don't have.
How the "Passport" Works
The Agent Passport is a digital document that acts like a strict contract. It says:
- Who you are: (Identity)
- What you can do: (e.g., "Read files," "Send emails")
- What you CANNOT do: (e.g., "Transfer more than $500," "Send money to countries X, Y, Z")
- The Rules: "If you try to break the rules, the system automatically says NO."
This system is Deterministic. This is a fancy word meaning: "If the inputs are the same, the answer is always the same."
- Unlike the AI, which might guess or hallucinate, the Passport system is like a math equation. is always $4$. If the rule says "No transfers over $500," it will always block a $501 transfer, even if the AI begs it to let it through.
The Proof: The "Vault" Test
The authors tested this system in a live game called the APort Vault CTF.
- The Setup: They set up a fake bank with a $5,000 prize for anyone who could trick the AI into stealing money.
- The Attackers: 1,151 people tried to use "social engineering" (tricks, lies, and pressure) to convince the AI to transfer money.
- The Result:
- When the AI was the only defense, attackers succeeded 74.6% of the time.
- When the OAP Passport was added, the attackers succeeded 0% of the time.
- The AI was tricked into asking for the money, but the Passport system said, "Nope, that's not in your rules," and blocked it.
Why Should You Care?
This isn't just about hackers. This is about accountability.
- Security: It stops hackers from tricking AI into stealing money or deleting data.
- Compliance: It ensures the AI follows laws (like GDPR) and company rules (like "Don't spend more than the budget").
- Trust: It gives us a "signed receipt" for every decision. If something goes wrong, we have a perfect record of who tried to do what and why it was blocked.
The Bottom Line
The paper says: Stop relying on the AI to be "good." Instead, build a system where the AI cannot be "bad" because the rules are enforced by a separate, unbreakable checkpoint.
It's the difference between hoping your teenager won't drive too fast, and installing a speed governor on the car that physically prevents it from going over 65 mph. The Open Agent Passport is that speed governor for AI.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.