Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecture

AI summary

Overview

Research area: AI safety and security for enterprise LLM agents, specifically dynamic least-privilege capability scoping, access control, and synthetic dataset construction for permission classification.

Technical level: Advanced. The paper assumes familiarity with capability-based security, IAM principals, zero trust architecture, indirect prompt injection, multi-label classification metrics, and Cohen's kappa. The prose is readable, but the framing sits at the intersection of enterprise security architecture and AI control research.

Scope: This paper proposes a three-source permission architecture for enterprise AI agents (role-based ceilings, a task-context classifier, and policy-derived combination prohibitions) and contributes a synthetic dataset of 600 enterprise task prompts with 15-permission labels, validated on a 60-record human-reviewed sample. It is explicitly the first of two contributions; the architecture itself is not empirically evaluated in this paper.

What This Paper Is About

Enterprise AI agents are usually handed a fixed set of credentials at configuration time covering everything their role might ever need, so an agent summarizing a document still holds tools it has no business reason to use. The paper argues that capability scoping should be dynamic and treated as prevention rather than detection: a credential that does not exist in an agent's context cannot be misused, no matter how capable the agent is at reasoning around monitoring. The goal is to lay out a layered permission architecture instantiating this principle and to release the grounded, labeled dataset needed to eventually train and evaluate the classifier that sits at its center.

Key Contributions

1. A three-source permission architecture. A layered design combining a deterministic role-based ceiling (Source 1), a fine-tuned multi-label task-context classifier over a 15-permission taxonomy (Source 2), and a deterministic policy filter that prohibits dangerous permission combinations such as the "lethal trifecta" (Source 3). A permission is granted only if all three sources permit it, and the architecture supports both enforcing and observe-only deployment modes.

2. A synthetic dataset of 600 enterprise task prompts. Prompts are grounded in a synthetic six-department company policy (TechCorp) and labeled with the minimum required permissions from a 15-permission tool-based taxonomy, built with a two-pass pipeline that separates prompt generation from permission labeling to avoid circularity.

3. A validated, human-reviewed labeling sample. A 60-record (10%) sample re-labeled independently by an expert reviewer achieved Cohen's κ = 0.917 pre-review and κ = 0.967 post-review, with the full disagreement log released for external audit.

4. Adaptive policy refinement as a methodology. Iterating between the generated dataset and the company policy reduced ceiling violations from 46 to 3, a 93% reduction, showing that synthetic prompt generation can act as a stress test that drives policy refinement when the two are co-evolved. The dataset, policy, generation pipeline, and validation outputs are released at https://github.com/0xballistics/mostargate under GPL-3.0.

Main Findings

• Pre-review label agreement is "almost perfect." Cohen's κ = 0.917 with a 95% confidence interval of [0.882, 0.953], placing the lower bound above the 0.80 threshold commonly cited for substantial agreement. The paper notes the pre-review figure is computed under the conservative assumption that human labels are always correct.

• Post-review agreement improves to κ = 0.967. The 95% confidence interval is [0.944, 0.990], reflecting the released labels after disagreement resolution. Figure 1 notes the absolute κ movement is 0.05.

• Full metric table (pre-review / post-review). Exact match rate 68.3% / 85.0%; Hamming accuracy 97.1% / 98.8%; Macro F1 0.920 / 0.966; overshoot rate 1.3% / 0.2%; undershoot rate 8.1% / 4.4%; severity-weighted overshoot 15.0 / 2.0; decisions evaluated N = 688 / 686.

• Severity-weighted overshoot fell 86.7%. This is described as the most security-relevant finding. The weighting counts a Tier 1 (default deny) over-grant as three times a Tier 3 over-grant, so the metric functions as a security risk score.

• Human labels contained real errors. Of 20 disagreements out of 60 records, 10 (50%) were attributed to human labeling error, 8 (40%) to LLM prediction error, and 2 (10%) were judged ambiguous and excluded from post-review computation. This near-parity is the paper's justification for using reviewed labels as ground truth.

• Residual error is conservative undershoot. The remaining 4.4% undershoot represents cases where the LLM denies a permission that should have been granted, which the paper argues is the preferred failure mode in principle, since an unwarranted grant expands attack surface while a missed grant only degrades task performance.

• Ceiling violations dropped from 46 to 3 (93%). The first generation run surfaced 46 prompts requiring permissions outside their department's ceiling. Resolutions comprised three ceiling expansions (email_read added to Engineering, Security, and Data and Analytics; http_request added to Data and Analytics; jira_read and jira_write added to Finance) and two policy clarifications (Salesforce CRM data is replicated to Snowflake and should be queried via database_read rather than salesforce_read; Legal's GDPR data subject requests route through Data and Analytics rather than direct database access). The remaining three were genuine edge cases.

• Sensitivity tier labels proved unreliable. Each record carries a LOW/MEDIUM/HIGH sensitivity tier label, but human-LLM raw agreement was 60%, far below permission agreement on the same sample. Of 24 adjudicated sensitivity disagreements, the human was correct in 17 cases (71%), the LLM in 6 (25%), with 1 ambiguous case (4%). Sensitivity labels are excluded from all classifier metrics and retained as descriptive metadata only.

• Architecture performance is not evaluated. The paper states plainly that the results do not prove architectural performance. No classifier has been trained or benchmarked, and no latency, cost, or deployment figures are reported.

Methodology in Plain English

The researchers built a fictional mid-sized SaaS company called TechCorp with six departments and wrote a policy document describing each department's tooling stack, typical workflows, and external communication patterns. The full policy text is in the released repository.

Task prompts were then generated in two separate LLM passes. Pass 1 produced prompts only, given the policy and a fixed department allocation (5 Engineering, 4 Customer Success, 3 each for Data and Analytics, Security, and Finance, and 2 Legal per batch of 20 prompts; thirty batches yield 600). Pass 1 had no knowledge of the permission taxonomy, and situational seeds such as end-of-quarter crunch, production incidents, and ad-hoc executive requests were injected alongside tone variations and occasional typos to produce realistic diversity. Pass 2 then labeled each prompt with its minimum required permissions, given the policy, the prompt, and the full 15-permission taxonomy with labeling rules. Pass 2 labeled permissions independently of the policy's combination prohibitions, because those are enforced by Source 3 at inference time rather than encoded in ground truth. Separating the passes prevents the model from producing prompts whose labels merely reflect how the prompt was phrased.

The permission taxonomy follows two design rules: every permission must correspond to a deployable credential type (so a grouped permission like internal_search was rejected as undeployable), and read/write are split wherever the security implications differ. Read operations primarily create exfiltration risk while write operations create persistence and impersonation risk. The taxonomy is grouped descriptively into Code, Knowledge, Communication, Data, and Session categories, but the underlying set is flat. Each permission also carries one of three risk tiers used for asymmetric confidence thresholds at inference time: Tier 1 (default deny), Tier 2 (grant with justification), Tier 3 (default permit). Tier assignments deliberately do not align with the conceptual categories.

Validation used a 10% random sample of 60 records independently re-labeled by a single expert reviewer with no access to the LLM's decisions, which prevents anchoring bias that a review-style validation would introduce. Disagreements were identified computationally afterwards and each was put to the reviewer in a separate pass, tagged as llm_correct (human error), human_correct (LLM error), or ambiguous. Agreement was measured with Cohen's kappa over the in-ceiling decision space only, because out-of-ceiling permissions would be trivially denied by both raters and inflate both observed and chance agreement together; this yields 688 binary decisions. The 95% confidence intervals use the standard error formula for Cohen's kappa from Fleiss, Cohen and Everitt.

Why This Matters

Impact on research. The paper reframes agent capability scoping as a prevention mechanism rather than a detection one, arguing that detection has a structural ceiling against agents that reason about monitoring and adapt, since an attacker only needs one phrasing the monitor misses. It positions a deterministic confinement layer as a complement to alignment, monitoring, and detection work, and releases a grounded enterprise prompt dataset that can support evaluation of permission classifiers as a form of contextual defense, a direction the paper connects to the utility-security trade-off described by Siu et al. (2026). The adaptive policy refinement result also suggests synthetic generation has methodological value beyond producing training data.

Real-world applications:

• Enterprise deployment of LLM agents with just-in-time credentialing, deploying only the credentials a task requires rather than a role's full tool envelope.
• Observe-only telemetry that logs when an agent invokes a tool the full system would have denied, providing a behavioral signal for security and alignment teams.
• Indirect prompt injection defense, by making the "lethal trifecta" of private data access, untrusted content exposure, and external communication structurally impossible.
• Privileged-service agents such as vulnerability management or model-weights-handling agents, where policy-level prohibitions can prevent side tasks that bypass role and task layers entirely.

Industry relevance. The paper maps its taxonomy directly onto deployable credential types such as Slack bot tokens, GitHub PATs, and database access certificates, and connects role ceilings to the IAM principal model used by AWS, where a principal can be a human or a service. It grounds itself in the OWASP LLM Top 10 LLM06 (Excessive Agency) entry and NIST SP 800-207 zero trust architecture, and it names PCAS, Policy-as-Prompt, and Conseca as the closest prior approaches. The concluding section cites reported incidents involving OpenClaw and Anthropic's reported Claude Mythos capabilities as motivation for AI control investment.

Future Directions

• Train the task-context classifier. The paper's stated immediate next step is training a dedicated Source 2 classifier on the released dataset to establish baseline overshoot and undershoot statistics, since the architecture's empirical performance depends directly on dataset and classifier quality.

• Evaluate the phased architecture progression C0–C3. The plan is to measure each source's contribution in stages: unenforced baseline (C0), role ceilings only (C1), adding the task classifier (C2), and finally enforcing policy prohibitions (C3).

• Integrate with AI control evaluations. The authors plan to deploy the setup as a custom micro-protocol within the ControlArena framework and test against deceptive model organisms to evaluate whether the system deterministically prevents hidden exfiltration side tasks.

• Resolve open design questions. These include multi-rater validation to establish true inter-rater reliability rather than relying on a single labeler, handling tasks with gradual scope creep in autonomous multi-step workflows such as ReAct loops, and adding parameter-level scoping in Source 3 so that internal VPC endpoints can be distinguished from public IP addresses. The paper also notes that tightening the trust assumption on an LLM-based task-context classifier is left to future work.

Target Audience

This paper is most useful to AI security architects and platform engineers designing credential provisioning for enterprise agents, to AI control and alignment researchers interested in deterministic confinement layers and observe-only telemetry as behavioral signals, and to security governance teams working on policy-as-code enforcement and zero trust for non-human identities. Dataset and benchmark researchers will also find value in the two-pass generation methodology and the adaptive policy refinement finding. Readers looking for measured classifier performance, deployment cost data, or latency figures will not find them here; the paper states that architectural evaluation is the subject of a planned follow-up.

Authors’ abstract

Enterprise AI agents are typically granted static credential sets at configuration time, holding every tool the role might need for every task they perform. This persistent over-privilege expands the attack surface. We argue that capability scoping must follow a dynamic least-privilege principle and be treated as a prevention mechanism before a detection one. A credential that does not exist in an agent's context cannot be misused regardless of the agent's reasoning or evasion sophistication. We outline a three-source architecture instantiating this principle: role-based ceilings, a task-context classifier, and policy-derived combination prohibitions creating a layered proactive defense against LLM agent misalignment and misuse cases. The architecture supports both enforcing and observe-only deployment; the latter records agent permission requests inconsistent with task context, producing a behavioral signal usable in misalignment research. As a first step toward evaluating this architecture, we contribute a synthetic dataset of 600 enterprise task prompts grounded in a multi-department company policy, labeled with minimum required permissions across a 15-permission tool-based taxonomy that maps directly to deployable credentials or enforceable guardrails. The dataset is constructed via a two-pass pipeline that separates prompt generation from permission labeling to avoid circularity, and is validated against a 60-record/688 decisions human-reviewed sample (Cohen's $κ= 0.917$ pre-review and $κ= 0.967$ post-review). Iterating between dataset and policy reduced ceiling violations from 46 to 3, a 93% reduction. This shows that synthetic prompt generation can drive policy refinement when the two are developed together. The dataset, environment specification, and generation pipeline are released to support evaluation of dynamic scoping mechanisms.