On this page
Static permissions say what an integration may do. IGAC asks what this request justifies—and enforces the difference.
Research status: Preprint. Original research date: 2026-06-22.
Authors: Genliang Zhu, Chu Wang.
Overview
An integration may legitimately hold broad permissions while the user’s current request is narrow. If a user asks for a summary, the agent should not gain export or delete authority simply because those tools are available.
Intent-Governed Access Control turns the trusted user request into an auditable intent certificate, narrows the tools visible in the current session, and checks whether the selected tool, payload, resources, and expected effect remain within that certificate. Ambiguous, low-confidence, or high-risk cases can be denied, clarified, or routed to OpenPort’s draft and preflight controls.
Core contributions
Problem formulation
Identifies intent–tool mismatch as an access-control failure: a call may be allowed by static credentials but unsupported by the user’s current expressed request.
Formal model
Defines intent certificates, monotone session-policy narrowing, intent-aware manifests, resource and effect bounds, consistency predicates, and auditable enforcement records.
Server-side design
Filters visible tools and validates tool, payload, resource, and effect consistency without treating the model, planner, or intent classifier as the final security principal.
Reusable runtime path
Maps IGAC onto OpenPort and implements a minimal path for certificate creation, intent-aware manifests, action and preflight checks, stable denial reasons, lifecycle isolation, and audit binding.
Preliminary evaluation
Provides deterministic checks, a runtime-backed synthetic microbenchmark, real-LLM pilots, and small end-to-end runtime studies. These support mechanism-level findings, not deployment-level safety claims.
Evidence and scope
This is an arXiv preprint. Its evidence is preliminary and largely synthetic or hand-authored; the LLM studies are modest in scale and provider-constrained, no production tenant data is used, and the current runtime is minimal and in-memory. The paper does not establish production readiness, deployment-level safety improvement, or a complete solution to prompt injection.
