用外部边界强制执行策略，防止智能体越权访问敏感数据
If Agents Were Angels, No Governance Would Be Necessary: Out-of-Band Policy Enforcement at a Trusted Tool Boundary
- 在智能体调用前，通过可信边界拦截并过滤请求，限制操作范围
- 测试中越权事件从57.6%降至0.2%，安全完成率提升21.8个百分点
- 适合需要严格数据保护的生产级AI系统，如企业运维与工单平台
赋予智能体人类凭证后，其可访问所有权限范围内数据，却无判断力限制使用。它能将可触及记录全量纳入模型上下文，隐藏指令引导后续行为，且每次请求仍保持凭证有效性，从而越权或窃取秘密。提示词作为防护机制脆弱且依赖单一推理者。本文提出出带外策略执行（OBPE），在智能体推理之外设立可信边界：授权操作类型与资源，缩小调用前查询范围，并在响应中过滤字段、屏蔽值或移除记录。语义门控可基于参数值或外部状态拒绝或暂停已授权调用。数据策略拥有者设定最大权限；智能体策略仅可进一步收紧。在给定条件下，证明策略计划与执行顺序无关，且智能体策略无法扩大上限。字段删除仅覆盖单次执行；掩码与历史规则影响更小。我们发布一个基于生产系统的简化版HTTP代理原型，配备与模型对齐的类型化Cedar策略核心。在Jira与ServiceNow模拟环境上，对比四种模型下有无OBPE的提示智能体，包含20个自适应红队任务。一次追踪失败定义为：敏感数据进入智能体上下文、精确值出现在答案中，或完成禁止操作。3,621次试验中，越权率从57.6%降至0.2%，聚类加权下降41.2点（95%置信区间：27.7, 54.9）；任务完成率从79.1%降至60.9%，但安全且有用完成率上升21.8点（9.5, 35.2）。部分答案重构了未进入上下文的值，或利用过滤后的行数作为判别依据：单次执行的屏蔽不满足非干扰性。写入控制、持久审批及时间与聚合策略不在本评估范围内。
原文摘要 · Abstract (English)
Give an agent a human's credential and it inherits the person's reach without the judgment that limits its use. It can sweep every reachable record into model context, where hidden instructions steer its next call, and every request stays credential-valid while the agent exceeds its job or absorbs a secret. Prompts are a brittle guardrail: one fallible reasoner interprets the task and enforces its limits. We present Out-of-Band Policy Enforcement (OBPE), a trusted boundary outside agent reasoning. It authorizes the typed operation and resource, narrows the query before the backend call, then filters records and fields or masks values in the response. Semantic gating can deny or hold an authorized call on argument values or external state. A data policy owner sets the maximum grant; agent policy can only narrow it. We prove, under stated conditions, that the policy plan is order-independent and agent policy cannot widen the ceiling. Field removal covers one execution; masking and history rules claim less. We release an HTTP proxy prototype simplified from our production system, with conformance tests tying its typed Cedar policy core to the model. Against Jira and ServiceNow mocks, our benchmark compares prompted agents with and without OBPE on four models, including 20 adaptive red-team tasks. A trace failure means protected data entered agent context, an exact value appeared in the answer, or a forbidden effect completed. In 3,621 trials it fell from 57.6% to 0.2%, a cluster-weighted reduction of 41.2 points [95% CI: 27.7, 54.9]; fulfillment fell from 79.1% to 60.9%, while paired safe-useful completion rose 21.8 points [9.5, 35.2]. Some answers reconstructed a value that never entered context or used filtered row counts as an oracle: shaping one execution is not noninterference. Write controls, durable approval, and temporal and aggregate policies lie outside this evaluation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。