为智能代理系统构建可验证的安全信任层，杜绝漏洞绕过。
Authenticated Workflows: A Systems Approach to Protecting Agentic AI
- 在提示、工具、数据、上下文四重边界上强制执行意图与完整性验证
- 实现100%召回率零误报，抵御9/10个OWASP顶级风险
- 适配9大主流框架，支持动态策略演进，适合企业级AI部署
智能代理系统自动化企业流程，但现有防御机制（如护栏、语义过滤）具有概率性且易被绕过。本文提出认证工作流，首个面向企业级智能代理的完整信任层。安全核心聚焦于保护四个基本边界：提示、工具、数据和上下文。在每个边界交叉处，同时确保操作符合组织策略（意图）并具备密码学真实性（完整性），结合密码学消除攻击类别与运行时策略执行，实现确定性安全——操作要么携带有效密码学证明，要么被直接拒绝。提出MAPL，一种原生支持智能代理的策略语言，能随代理演化和调用上下文变化动态表达约束，通过层次化组合将策略复杂度从O(M×N)降低至O(log M + N)，并为工作流依赖关系提供密码学背书。通过一个通用安全运行时，集成九个主流框架（MCP、A2A、OpenAI、Claude、LangChain、CrewAI、AutoGen、LlamaIndex、Haystack），仅需轻量适配器，无需协议修改。形式化证明保证完备性与正确性。实证验证显示，在174个测试案例中达成100%召回率与零误报，抵御9/10个OWASP Top 10风险，并完全缓解两个高危生产级CVE。
原文摘要 · Abstract (English)
Agentic AI systems automate enterprise workflows but existing defenses--guardrails, semantic filters--are probabilistic and routinely bypassed. We introduce authenticated workflows, the first complete trust layer for enterprise agentic AI. Security reduces to protecting four fundamental boundaries: prompts, tools, data, and context. We enforce intent (operations satisfy organizational policies) and integrity (operations are cryptographically authentic) at every boundary crossing, combining cryptographic elimination of attack classes with runtime policy enforcement. This delivers deterministic security--operations either carry valid cryptographic proof or are rejected. We introduce MAPL, an AI-native policy language that expresses agentic constraints dynamically as agents evolve and invocation context changes, scaling as O(log M + N) policies versus O(M x N) rules through hierarchical composition with cryptographic attestations for workflow dependencies. We prove practicality through a universal security runtime integrating nine leading frameworks (MCP, A2A, OpenAI, Claude, LangChain, CrewAI, AutoGen, LlamaIndex, Haystack) through thin adapters requiring zero protocol modifications. Formal proofs establish completeness and soundness. Empirical validation shows 100% recall with zero false positives across 174 test cases, protection against 9 of 10 OWASP Top 10 risks, and complete mitigation of two high impact production CVEs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。