Checking each action cannot stop safety failures in AI agents
A mathematical proof shows that safety guards inspecting individual actions without false alarms cannot detect violations that emerge only by comparing separate runs.
Edited by Boris Djordjevic · Paperfoot
In a preprint, the authors proved that per-action authorization cannot enforce global safety policies for autonomous language-model agents acting through tools. Today, security guards screen each tool call in isolation. The authors showed that relational purpose violations depend on comparing pairs of executions. Because no single run contains a point of blame, a monitor that never raises false alarms detects none of these violations, regardless of its underlying decision procedure. None of the six guardrail systems the authors surveyed monitors across runs.
The authors also built AL-SYNTH, a system that uses logic solvers without a language model to generate minimal failing examples. Across nine language-model judges, the systems approved the synthesized actions almost without exception, blocking them at rates comparable to benign controls. The same models flagged the violations when shown both executions together.
Why it matters
The mathematical proof shows that current security guardrails cannot protect autonomous agents from broad policy violations simply by filtering individual actions. To prevent these failures, future monitoring systems must either compare multiple runs or tolerate false alarms.
Caveats
The evaluation tested synthetic failure cases produced by the authors' tool rather than real-world agent workloads, and the abstract does not report the six surveyed guardrails or the nine models tested. The paper is also a preprint that has not yet been peer-reviewed.
In this paper
compositional authorization for LLM agents
- Methods
- AL-SYNTH (this paper)CaMeL (evaluated)Fides (evaluated)RTBAS (evaluated)SAFEFLOW (evaluated)
- Links
- Code
Results
- AL-SYNTH, witnesses, over depths three to seven on the cumulative-consent model: 1 to 29,337
All-SAT enumeration, used only for the completeness check, grows exponentially: from 1 to 29,337 witnesses over depths three to seven, and from 0.02 to 118 s, a gap of about 2,770 times at depth seven.
VII Validation and the Coverage Curve
What it shows
- A per-action monitor that never raises a false alarm cannot detect relational purpose violations, which form a 2-safety hyperproperty with no per-trace locus of blame.
Our central result is an impossibility: relational purpose violations form a 2-safety hyperproperty with no per-trace locus of blame, so a per-action monitor that never raises a false alarm detects none of them, independent of the underlying model or decision procedure; they become visible only under cross-execution monitoring, which none of the six guardrails we survey implements …
Abstract
- Single-trace monitors can enforce intent, provenance, consent, and delegation checks when instrumented, but cannot enforce the relational purpose conjunct without false positives.
Single-trace monitors can enforce intent, provenance, consent, and delegation checks when sufficiently instrumented, but not the relational purpose conjunct without false positives (Corollary 1).
IX Discussion
- No monitor seeing one single execution observable can soundly and completely decide context independence over all stochastic agents.
Over the class of all stochastic agents, no monitor that sees one such e can soundly and completely decide Y\perp H\mid\mathsf{low},D(\mathsf{hi}), where Y=\alpha(\mathsf{obs}).
Theorem 4 (Distributional Locus).
- AL-Synth synthesizes minimal compositional authorization failure witnesses that evade checks for a target profile without using a language model.
Given a model and a target class, it synthesizes a minimal CAF witness (a trace, or a pair of traces for the relational classes) that is locally authorized at every step and globally unauthorized and, for a target profile, also evades every check that profile can run.
VI AL-Synth: Constructive Synthesis
- Validation relies on differential testing on small synthetic models, and the guardrail matrix is derived from design bounds rather than executing guardrail code.
Our validation is differential testing on small models, not a proof of correctness and not a scalability study (§VII).
IX Discussion
Quoted word for word from the full text on arXiv.
The paper
Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents
arXiv, Oct 20, 2026, Open access, Preprint, not peer-reviewed
doi.org/10.48550/arxiv.2610.27620
arXiv:2610.27620v1 in cs.CR, also cs.AI, cs.LO
Comments: Extended version of a paper accepted at the 8th IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (IEEE TPS 2026), with full proofs and appendices. 12 pages, 5 figures, 7 tables. Code and data: https://github.com/anmolpandey299/al-synth
Cite as BibTeX
@misc{pandey2026local,
title = {Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents},
author = {Pandey, Anmol and Jain, Aditya and Chen, Liang and Maple, Carsten},
year = {2026},
eprint = {2610.27620},
archivePrefix = {arXiv},
primaryClass = {cs.CR},
doi = {10.48550/arxiv.2610.27620},
url = {https://arxiv.org/abs/2610.27620}
}
