CAGE: Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents
This work is significant for developers of tool-using LLM agents, as it enhances the robustness and security of authorization decisions against common data errors, preventing potentially unsafe actions.
This paper addresses the problem of authorizing actions for tool-using LLM agents, where authorization decisions are vulnerable to small errors in tool return binding and numerical values. The authors propose CAGE, a method that certifies authorization over a neighborhood of plausible returns, considering both categorical and numerical perturbations, and demonstrate that it removes in-budget false allows while maintaining a useful fraction of autonomous decisions.
Tool-using LLM agents act on typed tool returns, records pairing provenance and categorical fields with numerical values. Runtime permission gates generally authorize the observed return and action, leaving the decision unprotected against small errors in how the return was bound to its source. We ask whether a candidate action stays authorized over a declared neighborhood of plausible correctly bound returns: one admissible binding fault plus bounded numerical drift. We prove that certifying the categorical and numerical channels separately does not compose: perturbations that are safe on each channel alone can jointly turn the same action unsafe. CAGE certifies this joint neighborhood directly, enumerating the discrete branches exactly and certifying the continuous perturbation within each branch. Across synthetic, policy-as-code, regulatory, and real-transaction settings, CAGE removes the in-budget false allows that accurate pointwise gates admit, while keeping a useful fraction of decisions autonomous. When the policy is executable, CAGE-Exact certifies the policy itself; otherwise CAGE-Lip and CAGE-RS certify a learned gate under an explicit, measured fidelity assumption.