Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents.

arXiv:2610.27620v1 Announce Type: cross Abstract: Autonomous LLM agents act through tools under per-action authorization: a local guard screens each tool call in isolation. We show that local authorization does not compose into global authorization. A composit