Search papers, labs, and topics across Lattice.
This paper introduces FAVA, a novel framework for formal authorization of large language model (LLM) agents that addresses the limitations of static tool-level permissions in dynamic environments. By employing a Permission Intermediate Representation (IR) to convert natural-language tasks into structured constraints, FAVA creates an evidence-backed permission graph that tracks data flows and contextual dependencies. The framework's effectiveness is validated through rigorous evaluation, achieving a 90.5% Decision Compliance Rate (DCR) in intercepting violations across multiple scenarios, highlighting its potential for enhancing safety in LLM agent operations.
FAVA achieves a remarkable 90.5% compliance rate in dynamically authorizing LLM agent actions, showcasing a breakthrough in context-sensitive permission management.
Large language model (LLM) agents autonomously interleave semantic reasoning with complex system operations. In these dynamic environments, static tool-level permissions are fundamentally insufficient; safe authorization is highly context-dependent and heavily reliant on evolving runtime states and data flows. We present FAVA (Formal Authorization for Verified Agents), a permission-carrying authorization framework for agent execution. FAVA utilizes an LLM-guided Permission Intermediate Representation (IR) to translate ambiguous natural-language tasks into structured constraints. A deterministic lowering pass then converts this IR into an evidence-backed permission graph that explicitly tracks data flows, dependencies, and contextual labels. To provide strict security guarantees, a Satisfiability Modulo Theories (SMT) authorizer mathematically verifies the current graph against security policies before any effectful action executes. A runtime gateway then enforces the solver's result, either authorizing the execution or intercepting it with a precise counterexample. We evaluate FAVA across OpenAgentSafety, OctoBench, and ActPlane scenarios. Our evaluation demonstrates that FAVA achieves a 90.5% Decision Compliance Rate (DCR) over the aggregate dataset, successfully intercepting dynamic violating traces in the evaluated trace-conditioned scenarios.
