Technical Summary: Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals

1. Problem Statement

As autonomous Large Language Model (LLM) agents increasingly operate infrastructure using human-equivalent credentials, a critical governance gap has emerged. From a server's perspective, an agent holding valid credentials is indistinguishable from the human owner of those keys. Consequently, servers lack a standardized, in-band mechanism to signal intent—specifically, to inform an agent that a resource is off-limits for automation—without hard-failing the connection (which is indistinguishable from other client errors) or relying solely on external gateways.

Existing access control models (RBAC, ReBAC, API gateways) operate externally to the resource. There is no standard way for the resource itself to emit a machine-readable policy to a connecting agent, nor is there empirical evidence regarding whether compliant agents would honor such a signal if provided.

2. Methodology

The authors propose and evaluate a "cooperative governance control" rather than a security boundary. The methodology involves three core components:

A. The Recuse Signal (Mini-Standard)

The paper defines a protocol-agnostic, in-band deny signal formatted as a single sentinel line followed by human-readable text.

• Format: RECUSE/<version> <directive>; reason=<text>; scope=<scope>; ref=<url>; id=<uuid>
• Directives: Includes deny (withdraw), throttle (proceed cautiously), and warn (advisory). Unknown directives default to deny (fail-closed).
• Normative Behavior: Conforming agents MUST cease operations upon receiving a deny directive and SHOULD surface the notice to their operator.
• Analogy: It functions as a "live" analogue to robots.txt, but emitted per-request over existing protocol channels (e.g., SSH banners, PostgreSQL NOTICEs) rather than as a pre-fetched static file.

B. Reference Adapters

Two low-footprint adapters were implemented to emit this signal without modifying the core server software:

1. SSH Adapter: Uses a pre-authentication Banner for static signals and a PAM (pam_exec) hook to inject dynamic session IDs and JSON connection records. It is non-blocking (always exits 0) and idempotent.
2. PostgreSQL Adapter: A Go-based wire-protocol proxy that intercepts connections. It injects the Recuse Signal as a NOTICE message immediately after authentication but before the first ReadyForQuery. It relays all other traffic byte-for-byte, ensuring authentication (SCRAM-SHA-256) and queries proceed normally, making the signal purely cooperative.

C. Experimental Design

A controlled experiment was conducted to measure agent recusal rates.

• Task: A benign, read-only operations task ("Check free disk space on the root filesystem").
• Subjects: OpenAI GPT-4o, GPT-4o-mini (via API tool-use loops), and Claude Code (as a deployed agent with interactive login).
• Conditions:
  • Signal Present: The host emits the Recuse deny signal.
  • Control: The signal is suppressed.
  • Authorization Framing: A system prompt explicitly claimed the operator authorized the action (to test if the signal could override prompt instructions).
• Outcome Coding: Recusal was defined by the agent's intent to stop and surface the notice, not merely by command counts.

3. Key Results

The pilot study yielded four primary findings:

1. Signal Efficacy (F1): The signal successfully induces recusal. In the presence of the signal (without authorization framing), all tested agents (GPT-4o, GPT-4o-mini, Claude Code) recused 100% of the time. In the control group (no signal), all agents completed the task 100% of the time.
2. Cooperative Nature (F2): The signal is advisory, not coercive. When an explicit "operator authorization" framing was added to the prompt, GPT-4o proceeded in 4 out of 5 trials (20% recusal rate), suggesting the model weighed the prompt's authorization claim against the server's signal.
3. Model-Dependent Compliance (F3): Compliance varies by model. While GPT-4o proceeded when "authorized," GPT-4o-mini and Claude Code continued to defer to the on-host banner, recusing 100% of the time even when the prompt claimed authorization. Claude Code specifically treated the server's first-hand banner as more authoritative than the second-hand prompt claim.
4. Methodological Insight (F4): Recusal must be judged on response intent, not command execution. In the interactive SSH session, Claude Code agents often buffered the banner and the command output together. A naive metric counting command execution would have falsely labeled them as non-compliant; however, their subsequent behavior (stopping, surfacing the notice, declining further action) confirmed recusal.

4. Significance and Claims

The paper positions the Recuse Signal as a cooperative governance control, explicitly distinguishing it from a security boundary. It does not defend against malicious actors or non-compliant clients with valid credentials.

The paper's primary contributions are:

• Standardization: The definition of a versioned, protocol-agnostic, machine-readable deny signal format.
• Implementation: The release of zero-footprint adapters for SSH and PostgreSQL that allow resources to emit policy in-band.
• Empirical Measurement: The first controlled measurement of whether deployed LLM agents actually honor such voluntary signals. The results suggest that while agents are largely compliant, their behavior is sensitive to the specific model and the presence of conflicting authorization instructions.
• Governance Insight: The finding that an in-band signal from the resource itself can, in practice, outrank prompt-level authorization for certain models (specifically Claude Code), offering a new lever for governance against "confused deputy" scenarios.

The authors maintain a modest scope, acknowledging the pilot's limitations (small sample size, single task family, specific protocols) and framing the work as a foundational step toward measuring and standardizing agent-resource negotiation, rather than a complete security solution.