Security contracts bind LLM agent effects to authorisation

Problem

The paper studies how multiple, independently correct security controls in LLM agent pipelines can fail when composed. The authors identify security-context discontinuity, where security-relevant facts are lost, weakened, rebound, or reinterpreted as requests cross component boundaries. This can let an adversarial planner or a compromised non-root component cause an externally realised effect despite locally valid signatures or policy checks. The problem matters because modern agents routinely read untrusted content, synthesise plans, call tools, and produce effects that outlive a single model invocation, so composition failures enable prompt-injection style outcomes even when individual controls seem sound.

Approach

The authors formalise end-to-end consequence integrity (ECI) and present CONTINUITY, an assume-guarantee framework that carries authenticated security context across transitions. Key mechanisms include signed root grants, role-bound component identities, RFC 6901 style leaf paths, signed provenance and context manifests, bounded typed releases for untrusted-source values, independently verifiable transformation witnesses, role- and effect-bound transition receipts, and one-shot finality permits. A deterministic verifier validates proof-carrying transition bundles and issues permits that finality sinks recheck immediately before committing effects. The reference artefact is a Python 3.11+ prototype (1.5 KLOC core) using deterministic JSON encoding, SHA-256 digests and Ed25519 signatures. Evaluation uses a deterministic conformance suite with 32 cross-layer fault classes, four application domains, 20 parameterised instances per fault–domain pair, 700 benign tasks, 200 ambiguous tasks, yielding 3,460 scenarios and 24,220 system–scenario runs.

Key Findings

• CONTINUITY enforces ECI across the tested suite: in 2,560 parameterised attack instances spanning 128 fault–domain classes the full configuration committed no harmful external effect, while containing all 128 classes.
• The full system completed all 700 benign tasks automatically and escalated all 200 ambiguous tasks, demonstrating preserved utility for legitimate uses including 300 signed typed-release cases and legitimate destination transformation.
• Incomplete compositions are vulnerable: the strongest incomplete configuration (Gateway+Finality) had a harmful-effect success rate of 65.6% on attacks; other partial configurations reopened between 4 and 128 fault–domain classes.
• Targeted ablations show which invariants matter: removing field-provenance checks, contract conformance, or mediation reopened the most classes (24 each); root authentication, release validation, transform validation and replay protection also reopened notable subsets.
• Performance is modest in the prototype: median proof verification was 4.21 ms and median end-to-end transition production, verification, permit issuance and finality was 7.17 ms on the recorded host; verification scales roughly linearly with signed transitions.

Limitations

The guarantees are conditional on a specified trusted computing base: trusted root/grant issuers, provenance and transform validators, the deterministic verifier, key management and mediated finality sinks. The prototype is not formally verified, uses an intentionally restricted canonicaliser, stores nonce and outcome state in-memory, and covers only one evaluated relation (alias resolution). The fault taxonomy and deterministic suite are not exhaustive nor a measure of real-world attack probability. CONTINUITY does not solve semantic correctness, covert channels, malicious textual output not tied to a protected sink, or the consequences of a compromised root authority or validator.

Implications

From an offensive perspective, attackers who control the planner or compromise a non-root stage can exploit composition gaps to induce unauthorised effects by: substituting transformed fields after a policy decision, replaying or reusing permits, presenting stale policy or revocation state, or exploiting missing transformation witnesses. Compromising a root or a trusted validator undermines the whole chain and can produce authorised harmful effects. Even with CONTINUITY, adversaries can still mount denial-of-service by flooding rejected proposals, cause harmful textual outputs that are not finality-bound, or exploit any effect path not mediated by a compatible sink. The results stress that defenders must secure both individual controls and the authenticated contracts that bind them end-to-end.