TraceGrant locks LLM agents to contract-verified effects

Problem

The paper studies security for networked large language model agents that read email, cloud storage, calendars, transaction platforms and Web services to complete multistep tasks that produce persistent external effects. Runtime content needed for legitimate execution can also contain indirect prompt injections that redirect tool use, change authority-bearing arguments such as recipients or amounts, expand scopes or trigger extra operations. Existing defences tend to constrain untrusted content or single tool calls, but they do not keep the trusted user intent, admitted runtime evidence, concrete tool execution and final task completion linked across the whole task lifecycle. This gap enables attacks that convert necessary runtime data into unauthorised authority over external effects.

Approach

TraceGrant is a contract-governed framework that enforces a task-effect lifecycle from a trusted user request to verified task completion. Before execution a Semantic Contract Compiler derives a typed POEC (Permission, Obligation, Evidence, Completion) Contract from the user request and a frozen tool schema registry; deterministic static analysis rejects invalid or unsafe contracts. During execution an Obligation Ledger tracks pending and active obligations, and admitted query results are recorded only when they match BIND evidence rules. Each proposed effect is checked by a deterministic policy decision point (PDP) for permitted operations, active obligations, remaining call budget and typed argument proofs; on ALLOW the PDP issues a one-shot Effect Certificate and a policy enforcement point (PEP) dispatches the native call. After execution a post-execution verifier checks the actual tool, canonical arguments, execution status and observable postconditions and issues an Effect Receipt; the Final Answer Gate accepts completion only after all hard obligations are VERIFIED or appropriately WAIVED. The framework therefore treats runtime data as evidence that can instantiate pre-authorised slots, not as a source of new authority.

Key Findings

• Benchmark defence: Under fixed benchmark settings TraceGrant recorded zero successful benchmark attacks across 949 AgentDojo cases and 400 Agent Security Bench cases while retaining utility under attack of 77.32% (AgentDojo) and 83.00% (ASB).
• Model-agnostic security: Across four task-executing foundation models no attack success was observed under the fixed benchmark settings, though task utility varied by model.
• Component contributions: Stage ablations show the pre-execution Contract and runtime enforcement are critical. Removing the Contract or runtime checks raised specification violation and step-order errors (for example SVR rose to 64.19% without pre-execution specification) and increased false completion claims. Receipt-backed verification and the Final Answer Gate are essential for completion integrity.
• White-box analysis and residual risk: In a 100-case white-box set two attacks succeeded (2%) by poisoning admissible evidence fields; these reveal that evidence admittance of an object does not guarantee semantic authenticity of its internal fields and that incomplete binding of optional authority-bearing arguments can permit harmful effects.
• Performance: TraceGrant imposes measurable overhead: end-to-end latency increased by about 1.32× on AgentDojo and 1.41× on ASB, with token and call increases consistent with carrying security state and additional authorisation steps.

Limitations

TraceGrant’s guarantees rely on the Contract faithfully capturing all authority-bearing arguments, on evidence-source semantic authenticity, and on secure mediation of certificates and ledger operations. The framework does not by itself authenticate fields inside admissible objects and so remains vulnerable to evidence-source poisoning; the authors demonstrate two such white-box successes. Long-running, distributed, cross-session or multi-agent tasks, and deployments requiring step-up authentication channels or asynchronous services present additional engineering and trust challenges. The evaluation focuses on office, communication, travel and financial domains; broader domains will require richer binding and observability definitions.

Implications

For offensive security the results show that attackers who can control fields inside otherwise admissible objects may still induce unauthorised effects unless those fields are authenticated or explicitly bound in the Contract. An adversary able to plant malicious values in invoices, shared files or tool outputs can succeed if evidence admission treats object provenance as sufficient and the Contract omits a binding for optional authority-bearing arguments. TraceGrant reduces many attack paths by enforcing per-effect certificates, single-use grants and post-execution receipts, but it shifts attention to poisoning of admissible evidence fields and to completeness of Contract bindings as the practical attack surfaces defenders and attackers must consider.