PACE: Provenance-Aware Capability Enforcement for Tool-Using LLM Agents
PACE is a runtime enforcement framework for tool-using LLM agents that mediates each tool call just before execution, using provenance/path confinement plus capability and effect verification to ensure actions stay within authority derived from the authenticated request. Its key insight is that admission-time vetting of prompts, tools, memories, or retrieved artifacts is fundamentally insufficient because benign and malicious variants can be indistinguishable at admission, so enforcement has to happen at the final side-effect boundary; the reported benchmarks look strong, though the evidence is still limited to specific executable benchmark suites, model families, and a reduced-scale adaptive search.
Abstract
Tool-using large language model (LLM) agents turn generated text into real side effects, so poisoned tool metadata, retrieved pages, memory, and reusable skills can steer the next call. Vetting an artifact before admission does not settle this. A safe variant and a leaking variant can produce the same admission evidence, and a sound gate then cannot relax that site for either. We make that condition precise, which leaves the last boundary a deployment can still act on. We present Provenance-Aware Capability Enforcement (PACE), which mediates every tool call immediately before it executes. Path confinement proposes an executable cut of represented influence paths, while capability and effect verification checks schema-defined effects against authority compiled from the authenticated request. We distinguish the certified execution contract from the evaluated configuration, which can restore an authorized call after a proposed block or apply a declared repair. Confinement requires the final action to preserve the certified cut. On eight executable agent-security benchmarks with three target-model families, the evaluated configuration gives strictly lowest attack success in 62 of 79 eligible attack columns and ties in 14; full-benchmark native utility loses at most three points relative to the undefended agent. A complete ablation over 1167 paired cases attributes most security gains to effect verification and refusal control to boundary adaptation. A reduced-scale adaptive search succeeds on 0/30 out-of-authority targets against the defense.