TraceGrant: A Contract-Governed Security Framework for the Task-Effect Lifecycle of Networked LLM Agents
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Networked large language model (LLM) agents retrieve information from email, cloud storage, calendars, transaction platforms, and Web services to complete multistep tasks that produce persistent external effects. The same content needed for legitimate execution may also contain indirect prompt injections that redirect tool use, alter sensitive arguments, or disrupt task completion. Existing defenses mainly constrain untrusted content or individual tool calls, leaving user intent, runtime evidence, realized effects, and task completion insufficiently connected. We present TraceGrant, a security framework that governs the task-effect lifecycle of networked LLM agents through an explicit Contract. Before execution, TraceGrant establishes a task-effect boundary from the trusted user request. During execution, admitted evidence can instantiate only authority already established by the Contract. After execution, task completion is verified against actual tool results. Across 949 AgentDojo and 400 Agent Security Bench attack cases under fixed benchmark settings, TraceGrant recorded no attack successes while retaining utility under attack rates of 77.32% and 83.00%, respectively. We further evaluate TraceGrant through white-box defense-aware attacks, Contract quality analysis, stage ablations, targeted stress tests, and runtime overhead measurements. The results show that TraceGrant provides a unified governance layer that connects trusted user intent, runtime evidence, concrete tool execution, and verified task completion.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 13 of its 17 references that are in the map. First posted on arXiv 21 Aug 2026.
Builds on
13 of 17 references.
Closest ancestors · 6
Same direction, newest first
- 2025Defeating Prompt Injections by Design24 Mar
- 2025AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents24 Mar
- 2024The Task Shield: Enforcing Task Alignment to Defend Against Indirect Prompt Injection in LLM Agents21 Dec
- 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents3 Oct
- 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems8 Mar
- 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents5 Mar
Other references · 7
- 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
- 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,182
- 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,947
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
- 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 364
- 2025Securing AI Agents with Information-Flow Controlcited by 121
- 2024AutoGen Studio: A No-Code Developer Tool for Building and Debugging Multi-Agent Systemscited by 20
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation
- 2025AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents
- 2026AgentVisor: Defending LLM Agents Against Prompt Injection via Semantic Virtualization
- 2026Securing LLM Agents Need Intent-to-Execution Integrity
- 2026ContainmentBench: Trace-Based Evaluation of Post-Exposure Containment in Tool-Using LLM Agents
- 2024Whispers in the Machine: Confidentiality in Agentic Systems
- 2025MCP Security Bench (MSB): Benchmarking Attacks Against Model Context Protocol in LLM Agents
- 2026PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents