Monotonic Privilege Confinement

Problem

A policy that can be rewritten mid-run is only as trustworthy as its update path. The untrusted content a revision is meant to react to — a fetched page, an inbound message, a tool result — is present when the revision is proposed, so an injected instruction can ask for an update that adds a tool, loosens an argument constraint, or raises a spend ceiling. A free-form update mechanism has no way to tell a tightening the task legitimately needs from a widening an attacker planted, and once the wider policy is in force every later call passes the check honestly. Escalation then looks exactly like adaptation, and the audit trail records an allowed action rather than an incident.

Solution

Represent the policy as symbolic rules over tool names and argument values, so two versions of it can be compared by a decision procedure rather than by reading. Generate the first version from the task before any external content has been read. When execution suggests a revision, do not apply it: hand the current policy and the candidate to a solver that decides whether the candidate's permitted set is contained in the current one. Containment means the update only removes reachable calls, so it applies on its own and needs no person. Any other result is an expansion, and an expansion is held until a principal outside the run approves it; the agent cannot approve its own. The effective action space therefore moves in one direction for the whole run, and a contamination event such as reading untrusted tool output can itself force a narrowing, cutting future authority the moment attacker-influenced data enters the state. Restriction need not be all-or-nothing: graded strategies remove reachability along particular argument flows instead of dropping whole tools, which keeps more of the task completable at the same attack success rate. Because the check is symbolic it adds no model call and no tokens.

When to use

• The policy governing tool calls is derived from the task at runtime rather than authored in advance by an operator.
• The agent reads content it did not author — web pages, inbound messages, tool results — during the same run in which its policy can change.
• The permitted set can be written as symbolic rules over tool names and argument values that a solver can compare for containment.
• An expansion can be routed to a principal outside the run who answers within the task's latency budget.