# Subjects, Not Authors: The Authorship Hazard in Agentic Dataspaces

arXiv: https://arxiv.org/abs/2609.30614 · HTML: https://mlsanity.com/paper/2609.30614/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 18 of its 47 references that are in the map.
- First posted on arXiv 24 Sep 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 18 of 18)

- [InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents](https://mlsanity.com/paper/2403.02691/) (2024)
- [The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions](https://mlsanity.com/paper/2404.13208/) (2024)
- [AgentSpec: Customizable Runtime Enforcement for Safe and Reliable LLM Agents](https://mlsanity.com/paper/2503.18666/) (2025)
- [Progent: Securing AI Agents with Privilege Control](https://mlsanity.com/paper/2504.11703/) (2025)
- [Taxonomy of Attacks on Open-Source Software Supply Chains](https://mlsanity.com/paper/2204.04008/) (2022)
- [Agent-OM: Leveraging LLM Agents for Ontology Matching](https://mlsanity.com/paper/2312.00326/) (2023)
- [LLM-empowered knowledge graph construction: A survey](https://mlsanity.com/paper/2510.20345/) (2025)
- [AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A](https://mlsanity.com/paper/2603.24775/) (2026)
- [Trojan Source: Invisible Vulnerabilities](https://mlsanity.com/paper/2111.00169/) (2021)
- [Open Digital Rights Enforcement Framework (ODRE): from descriptive to enforceable policies](https://mlsanity.com/paper/2409.17602/) (2024)
- [Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI](https://mlsanity.com/paper/2606.03518/) (2026)
- [Deontic Policies for Runtime Governance of Agentic AI Systems](https://mlsanity.com/paper/2606.19464/) (2026)
- [From Instructions to ODRL Usage Policies: An Ontology Guided Approach](https://mlsanity.com/paper/2506.03301/) (2025)
- [AgentODRL: A Large Language Model-based Multi-agent System for ODRL Generation](https://mlsanity.com/paper/2512.00602/) (2025)
- [DAVE: A Policy-Enforcing LLM Spokesperson for Secure Multi-Document Data Sharing](https://mlsanity.com/paper/2602.17413/) (2026)
- [Towards Automated Ontology Generation from Unstructured Text: A Multi-Agent LLM Approach](https://mlsanity.com/paper/2604.23090/) (2026)
- [Prompts Don't Protect: Architectural Enforcement via MCP Proxy for LLM Tool Access Control](https://mlsanity.com/paper/2605.18414/) (2026)
- [ActGov: Governing LLM Agent Actions via Policy-Constrained Validation](https://mlsanity.com/paper/2609.24446/) (2026)

## Abstract (arXiv)

Dataspace connectors decide whether a transfer may occur, not what the transferred value contains, tolerable for contracted applications, not for LLM agents that compose tool calls. Work on agents that generate governance artifacts evaluates output quality, not who may authorize an artifact for use. A published policy is what the decision point enforces, so publication is a governance event, and agents that are both policy subjects and policy authors write the norms that bind them. We name this the authorship hazard and state one principle: an agent is a subject of the governance plane, never an author of it. Its authorization channel to publication is closed by construction; its influence channel, drafting what humans approve, becomes an enforcement problem. Across 90 preregistered edits to the paper's running agreement, each evaluated on 344,512 requests, the six that only reclassify a field all change authorization and narrow a duty without touching policy text, and a policy-diff classifier passes all six. Read as worded, the privilege-delta conditions also pass 33 of 69 effective policy-text edits; read as covering any relaxation, none. Treating classification as authorship routes all six to review; the registry this requires is not yet built. At the execution boundary, protected fields reach the model in 105 of 105 cases under prompt-stated duties and in 0 of 105 under a compiled tool-call constraint, but values outside named fields are exposed in 7 of 7. At the review share measured, a central approval pool needs one approver per 20 to 138 participants.