MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents
- ID: 971ee340
- 原文链接: https://arxiv.org/abs/2512.11147
- PDF: https://arxiv.org/pdf/2512.11147v1
- 作者: Jinhao Zhu, Kevin Tseng, Gil Vernik, Xiao Huang, Shishir G. Patil, Vivian Fang, Raluca Ada Popa
- 日期: 2025-12-11
- 更新: 2025-12-11
- 分类: agents
- 来源类型: paper
- 标签: least-privilege, tool-calling, agent-security, authorization, cs.cr
- 质量评分: 4/5
- 抓取时间: 2026-07-25T04:19:44+00:00
中文导读
MiniScope 关注 ChatGPTClaudeGemini 等平台连接器和自主能力带来的账号授权风险摘要强调既有方案要么依赖人工策略要么把 LLM 放进约束闭环而缺少严格保证；MiniScope 的价值在于把工具调用 Agent 访问用户账号时的潜在损害限制在最小权限边界内
为什么值得关注
当 Agent 直接接入用户服务时，授权框架要限制可能造成的损害，而不是只判断回答是否安全
这篇论文属于 AAIF 的 Agent 安全/评估线索：它不是泛泛讨论“让模型更安全”，而是把风险落到工具调用、权限继承、授权边界或集合级效用等可被工程系统观测与约束的对象上。对于正在构建工具型 Agent、连接器、沙箱评测或推荐型 Agent 的团队，它提供了一个更具体的检查维度：模型输出之外，系统还需要回答“Agent 被允许做什么、实际做了什么、这些动作对用户账户/环境/推荐集合造成什么后果”。
关键信息
- 论文标题：MiniScope: A Least Privilege Framework for Authorizing Tool Calling Agents
- 作者：Jinhao Zhu, Kevin Tseng, Gil Vernik, Xiao Huang, Shishir G. Patil, Vivian Fang, Raluca Ada Popa
- arXiv：https://arxiv.org/abs/2512.11147
- 发布时间：2025-12-11
- arXiv 分类：cs.CR, cs.AI
- 关联标签：least-privilege, tool-calling, agent-security, authorization, cs.cr
English Abstract
Tool calling agents are an emerging paradigm in LLM deployment, with major platforms such as ChatGPT, Claude, and Gemini adding connectors and autonomous capabilities. However, the inherent unreliability of LLMs introduces fundamental security risks when these agents operate over sensitive user services. Prior approaches either rely on manually written policies that require security expertise, or place LLMs in the confinement loop, which lacks rigorous security guarantees. We present MiniScope, a framework that enables tool calling agents to operate on user accounts while confining potential damage from unreliable LLMs. MiniScope introduces a novel way to automatically and rigorously enforce least privilege principles by reconstructing permission hierarchies that reflect relationships among tool calls and combining them with a mobile-style permission model to balance security and ease of use. To evaluate MiniScope, we create a synthetic dataset derived from ten popular real-world applications, capturing the complexity of realistic agentic tasks beyond existing simplified benchmarks. Our evaluation shows that MiniScope incurs only 1-6% latency overhead compared to vanilla tool calling agents, while significantly outperforming the LLM based baseline in minimizing permissions as well as computational and operational costs.
English Summary
Tool calling agents are an emerging paradigm in LLM deployment, with major platforms such as ChatGPT, Claude, and Gemini adding connectors and autonomous capabilities. However, the inherent unreliability of LLMs introduces fundamental security risks when these agents operate over sensitive user services. Prior approaches either rely on manually written policies that require security expertise, or place LLMs in the confinement loop, which lacks rigorous security guarantees. We present MiniScope, a framework that enables tool calling agents to operate on user accounts while confining potential damage from unreliable LLMs. MiniScope introduces a novel way to automatically and rigorously enforce least privilege principles by reconstructing permission hierarchies that reflect relationships among tool calls and combining them with a mobile-style permission model to balance security and ease of use. To evaluate MiniScope, we create a synthetic dataset derived from ten popular real-world applications, capturing the complexity of realistic agentic tasks beyond existing simplified benchmarks. Our evaluation shows that MiniScope incurs only 1-6% latency overhead compared to vanilla tool calling agents, while significantly outperforming the LLM based baseline in minimizing permissions as well as computational and operational costs.
Obsidian Notes
- 内容由
opencli arxiv paper拉取 arXiv 元数据与摘要生成。 - 中文导读与价值判断均锚定在条目已有摘要、论文摘要、作者、日期与分类信息上；未补充论文摘要之外的实验细节。