Reproduce “Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Anmol Pandey, Aditya Jain, Liang Chen, Carsten Maple
The authors show that per-action authorization can miss purpose violations revealed only by comparing executions. In a scheduling example, two compliant runs share an authorized free/busy view but offer different slots because of a hidden reason. When such pairs are possible, no false-alarm-free single-run monitor can detect the mismatch. GPT-5.5 blocked 0/30 witnesses per action and 30/30 when shown both runs.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.