让AI代理按需获取权限，避免过度授权风险
Beyond Static Sandboxing: Learned Capability Governance for Autonomous AI Agents
- 基于强化学习动态学习每类任务的最小必要能力集
- 通过混合规则与微调分类器拦截非法工具调用，降低误判率
- 适用于需严格权限管控的自主AI系统，如代码部署、数据处理
基于开源运行时（如OpenClaw）构建的自主AI代理默认向所有会话开放全部工具，无论任务类型。例如，摘要任务与代码部署任务享有相同的命令行执行、子代理创建和凭证访问权限，导致能力过度分配，我们称之为能力过度分配问题，其比例高达15倍。现有防御措施（如NemoClaw容器沙箱、Cisco DefenseClaw技能扫描器）仅关注隔离与威胁检测，无法学习每类任务的最小可行能力集。本文提出Aethelgard，一种四层自适应治理框架，通过学习策略实现对AI代理的最小权限控制。第1层：能力管理者动态限定每个会话中代理可见的工具；第3层：安全路由器在执行前使用混合规则与微调分类器拦截工具调用；第2层：基于累积审计日志训练PPO策略，学习各类任务的最小可行技能集。
原文摘要 · Abstract (English)
Autonomous AI agents built on open-source runtimes such as OpenClaw expose every available tool to every session by default, regardless of the task. A summarization task receives the same shell execution, subagent spawning, and credential access capabilities as a code deployment task, a 15x overprovision ratio that we call the capability overprovisioning problem. Existing defenses, including the NemoClaw container sandbox and the Cisco DefenseClaw skill scanner, address containment and threat detection but do not learn the minimum viable capability set for each task type. We present Aethelgard, a four layer adaptive governance framework that enforces least privilege for AI agents through a learned policy. Layer 1, the Capability Governor, dynamically scopes which tools the agent is aware of in each session. Layer 3, the Safety Router, intercepts tool calls before execution using a hybrid rule based and fine tuned classifier. Layer 2, the RL Learning Policy, trains a PPO policy on the accumulated audit log to learn the minimum viable skill set for each task type.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。