# Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices

arXiv: https://arxiv.org/abs/2603.17170 · HTML: https://mlsanity.com/paper/2603.17170/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 39 references that are in the map.
- First posted on arXiv 17 Mar 2026.

## Builds on (most cited first, 14 of 14)

- [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023)
- [Prompt Injection attack against LLM-integrated Applications](https://mlsanity.com/paper/2306.05499/) (2023)
- [Identifying the Risks of LM Agents with an LM-Emulated Sandbox](https://mlsanity.com/paper/2309.15817/) (2023)
- [InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents](https://mlsanity.com/paper/2403.02691/) (2024)
- [The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions](https://mlsanity.com/paper/2404.13208/) (2024)
- [StruQ: Defending Against Prompt Injection with Structured Queries](https://mlsanity.com/paper/2402.06363/) (2024)
- [Formalizing and Benchmarking Prompt Injection Attacks and Defenses](https://mlsanity.com/paper/2310.12815/) (2023)
- [Defeating Prompt Injections by Design](https://mlsanity.com/paper/2503.18813/) (2025)
- [IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems](https://mlsanity.com/paper/2403.04960/) (2024)
- [PLeak: Prompt Leaking Attacks against Large Language Model Applications](https://mlsanity.com/paper/2405.06823/) (2024)
- [LLMs Cannot Reliably Identify and Reason About Security Vulnerabilities (Yet?): A Comprehensive Evaluation, Framework, and Benchmarks](https://mlsanity.com/paper/2312.12575/) (2023)
- [MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits](https://mlsanity.com/paper/2504.03767/) (2025)
- [Improving the Robustness of Transformer-based Large Language Models with Dynamic Attention](https://mlsanity.com/paper/2311.17400/) (2023)
- [AgentRaft: Automated Detection of Data Over-Exposure in LLM Agents](https://mlsanity.com/paper/2603.07557/) (2026)

## Built on by (most cited first, 5 of 5)

- [AID-Guard: Stateful Authorization for Delegated Agent Effects](https://mlsanity.com/paper/2608.21159/) (2026)
- [The Vulnerability With No CVE: Managing Persistent Gaps Between Mandate and Authority in AI Coding Agents](https://mlsanity.com/paper/2608.05884/) (2026)
- [AgentBetta: Verification-Driven Adaptive Configuration of an AI Nano-Agent through Selective Expansion and Verified Contraction](https://mlsanity.com/paper/2609.23512/) (2026)
- [LeaseGuard: Incumbent-Preserving Admission Control for Privileged LLM Agents](https://mlsanity.com/paper/2609.24077/) (2026)
- [Fault-Tolerant Budget Conservation in Distributed Multi-Agent Delegation](https://mlsanity.com/paper/2610.00349/) (2026)

## Abstract (arXiv)

AI agents increasingly execute users' natural-language (NL) tasks by calling Web services, yet today's Web authorizes these calls through OAuth, which grants permissions over operators (e.g., TRANSFER), not operations (operator plus operands, e.g., transfer 100 to Bob). This gap cannot be closed by refining scope granularity, because operands are combinatorial, quantitative, and often derived from runtime computations across servers. Operator-scoped authorization therefore inherently overprivileges agents. We propose Precise Task-Scoped Implicit Authorization (PAuth): submitting a concrete NL task implicitly authorizes exactly the operations its faithful execution requires, even when the agent is compromised (e.g., by malware or prompt injection). Each server independently derives an NL slice, a symbolic specification of the expected call inspired by program slicing, and server-produced values are wrapped in signed envelopes that bind concrete values to symbolic provenance. Together, they enforce that every operation, not just the operator, is consistent with the user's task, closing the gap that OAuth leaves open. We evaluate PAuth on AuthBench, a benchmark we build on top of AgentDojo and cross-validate on OpenClaw, spanning five service suites with 100 benign tasks and 634 adversarial calls. All 100 benign tasks are implicitly authorized and all 634 adversarial calls are blocked. Many tasks require multiple tool calls to complete. A unique value of PAuth is that it frees users from having to approve each call with concrete operand values, including intermediate results they never specified. This enhances both security and usability.