When AI Acts Alone: Can We Trust Its 'Permissions'?

Imagine an AI assistant that doesn't just answer but books flights, moves money, or writes code on your behalf. It sounds like sci-fi, but "LLM agents" are becoming real: language models that use external tools to act in the physical world. Here lies the problem: classic cybersecurity was built for rigid programs where "if you click A, B happens." LLM agents, however, reason via probability and natural language: "maybe the user meant A, maybe B."

A recent study (arXiv:2512.06914) puts the core risk in writing: a gap between **trust** and **authorization**. We tend to trust the agent because it "understands" context, but its permissions (what it can actually do) remain static and often too broad. It is the Principle of Least Privilege violated by language ambiguity.

Researchers built a formal model to measure this "Trust-Authorization Gap." They use it as a lens to classify known attacks — like *prompt injections* hijacking the agent, or tool misuse — and current defenses, often disconnected. The result? A unified map showing where we are exposed: we lack dynamic authorization mechanisms that adapt to the conversation context, and computable trust models, not just intuitive ones.

The path forward is clear: we need "robust" agents that know when to say "I didn't understand, I won't act," and permission systems that shrink or expand in real-time, just like a prudent human would. AI security is no longer just code; it is uncertainty management.

The paper "SoK: Trust-Authorization Mismatch in LLM Agent Interactions" (arXiv:2512.06914v1) provides the first formal Systematization of Knowledge (SoK) for LLM agent security. The core contribution is the definition of the **Trust-Authorization Gap**: a structural discrepancy between the *Trust Score* (probabilistic assessment of agent reliability based on context, history, alignment) and the *Authorization Policy* (static set of permissions/tools granted to the agent, e.g., API keys, filesystem access).

The authors formalize the interaction as a tuple \( (User, Agent, Environment, Policy) \). They prove that since the agent operates in a partially observable state space and its actions are stochastic LLM outputs, verification of compliance with the Policy (Principle of Least Privilege - PoLP) is undecidable in real-time using static methods (model checking, type systems).

The attack taxonomy is reorganized into three main vectors: 1) **Trust Manipulation** (e.g., Prompt Injection, Jailbreak, Context Poisoning) artificially inflating the Trust Score; 2) **Authorization Escalation** (e.g., Tool Misuse, Parameter Tampering, Confused Deputy) exploiting excessive permissions; 3) **Policy Evasion** (e.g., Chain-of-Thought obfuscation, Steganography) hiding malicious intent from monitors.

Current defenses (Guardrails, Output Filters, Sandboxing) are classified as *Static* (pre-deployment) or *Runtime* (post-hoc), highlighting that none closes the gap dynamically. Future research directions require: **Dynamic Authorization** (ABAC policies updated per-step via Trust Score), **Verifiable Reasoning** (formal proofs of CoT-policy alignment), and **Agent Intrusion Detection Systems (AIDS)** based on sequential behavioral anomalies, not just token-level.