Capability-Mediated Perimeters for Secure AI Agent Tool Execution: Conditional Non-Escalation Invariants and Empirical Evaluation Against Indirect Prompt Injection

Abstract

Abstract — Autonomous artificial intelligence agents executing over extensible tool interfaces (such as Anthropic's Model Context Protocol) operate with ambient authority over connected tools. Because autoregressive Transformers ingest instructions and untrusted third-party data within a single homogeneous context window, adversarial observations can manipulate the model into executing unintended privileged actions—the classic Confused Deputy problem. In this paper, we explore an architectural defense-in-depth approach that treats LLM agents as potentially compromised, untrusted principals. Rather than relying on linguistic moderation alone, tool dispatch is governed by an external capability-mediated reference monitor enforcing complete mediation, least privilege, and four typed relational argument invariants (destination containment, scope boundedness, privilege monotonicity, and aggregate monetary clamping). Under complete mediation axioms (A1–A6) over the trusted computing base, out-of-scope tool invocation is deterministically rejected at the transport boundary, formalized as an Inductive Multi-Step Tool Chain Composability Invariant (Proposition 1) showing that adversarial observations cannot synthesize authority across arbitrary execution sequences. However, in-scope parameter poisoning within authorized tools and cross-tool data exfiltration present harder challenges: semantic neural validation is distribution-bounded (exhibiting an empirical false-negative rate of 21.5% on in-scope manipulations prior to boundary sharpening and remaining susceptible to adversarial optimization), while cross-tool exfiltration requires explicit decentralized information-flow tracking (DIFC). We further introduce declarative stateful workflow authorization, which constrains specified multi-step action sequences as a restrictive intersection with CBAC and DIFC, and validate the integrated gateway through 23 author-constructed adversarial workflow tests covering trajectory, concurrency, desynchronization, execution uncertainty, and receipt-integrity attacks. We report empirical evaluations across both foundational baseline studies (a 50,000-sample macro benchmark and a 3,000-case ablation matrix) and a Six-Regime Empirical Validation Program totaling 6,662 evaluation cases with frozen checkpoint V6: achieving 100% Correct Identification Rate on internal factorized diagnostics (N = 145), 100% accuracy on a pre-sealed holdout suite (75/75, SHA-256: 22bc736c...), 98.43% defense on the 4,216-instance InjecAgent evaluation (2,075/2,108 attacks blocked, 1,916/2,108 benign allowed) (P50: 267.7 ms), 92.44% defense on AI Safety Bench (416/450 attacks blocked, 550/550 benign operations allowed), 99.52% attack defense on interactive AgentDojo (N = 629) with exact clean-task utility parity (6/97 tasks) matching the unprotected base agent, and 100% defense across 500 targeted adaptive red-team trials. Finally, we systemize the runtime into the Mastyf Security Gateway: the evaluated research runtime was v0.1.0-RC1 (verifying 38/38 security invariant tests); the hardened commercial-pilot runtime is v0.1.1-rc1 (verifying 118/118 tests across unit, integration, and adversarial suites), establishing complete mediation non-executability (Decision ∈ {BLOCK, ESCALATE} ⇒ BackendToolInvocations = 0) and >330,000 req/s reference monitor throughput under an Ed25519-signed release manifest. We contextualize Mastyf as an empirically evaluated pre-production architecture, highlighting residual risks and outlining requirements for broader production-scale validation.