AgentGuardian: Learning Access Control Policies

• AgentGuardian is a security framework that learns per-tool, context-aware access-control policies to regulate AI agent tool use via multi-step control-flow evaluation.
• It employs a two-phase process of benign trace monitoring for policy generation followed by lightweight runtime enforcement, ensuring low false reject rates.
• Empirical evaluations show its effectiveness in mitigating prompt injections and hallucination-driven misuse across diverse multi-agent applications with minimal latency overhead.

Searching arXiv for the primary and related papers to ground the article. arxiv_search: AgentGuardian Learning Access Control Policies to Govern AI Agent Behavior (Abaev et al., 15 Jan 2026) Searching for the primary AgentGuardian paper and closely related guard frameworks on arXiv. AgentGuardian is a security framework for governing AI agent operations by enforcing context-aware access-control policies over tool use. In the formulation introduced in "AgentGuardian: Learning Access Control Policies to Govern AI Agent Behavior," the framework observes benign execution traces during a controlled staging phase, learns legitimate input patterns and control-flow dependencies, and then applies the resulting policies at runtime to regulate tool calls. Its stated objectives are to automatically learn per-tool, context-aware access-control policies, enforce both fine-grained input constraints and valid control-flow trajectories, and mitigate prompt injections, tool-sequence attacks, and hallucination-driven misuse while preserving normal agent functionality (Abaev et al., 15 Jan 2026).

1. Problem setting and security model

AgentGuardian is motivated by two coupled problems in tool-using AI agents. The first is the security of tool chains: prompt injection, whether direct or indirect, can subvert an agent’s reasoning and convert benign tools such as file I/O or network calls into attack vectors. The second is governance and consistency: LLMs may hallucinate, and identical inputs may yield different reasoning paths or tool sequences. The framework is presented as a response to the limits of static guardrails, text-level filters, and manually enumerated RBAC or ABAC policies that do not adapt to dynamic agent behavior (Abaev et al., 15 Jan 2026).

The framework defines legitimate behavior empirically. Let $\mathcal{T}=\{T^1,\dots,T^N\}$ be the set of tools and $\mathcal{S}=\{S_1,\dots,S_M\}$ the observed tool-call sequences, where

$$S_i=\bigl\{T^n_{i,1},T^n_{i,2},\dots,T^n_{i,J_i}\bigr\}.$$

A behavior is treated as legitimate if the tool sequence and its inputs appear in the benign staging dataset $\mathcal{D}$. This framing ties policy learning directly to observed orchestration behavior rather than to a purely hand-written rule set (Abaev et al., 15 Jan 2026).

A central design choice is the inclusion of control-flow constraints. AgentGuardian does not evaluate a tool call only as an isolated event; it also asks whether the call is valid in the current execution trajectory. This is significant because the paper explicitly targets multi-step agent actions and orchestration-level malfunctions, not merely malformed single-step calls (Abaev et al., 15 Jan 2026).

2. System architecture and execution lifecycle

AgentGuardian comprises two phases: a Controlled Staging Phase for policy generation and a Runtime Enforcement Phase for policy application. Its high-level workflow contains three core components: Monitoring Tool, Policy Generator, and Policy Enforcer. During staging, the monitoring layer collects LLM events and tool calls; the policy generator reconstructs tool-call sequences, a control-flow graph, and per-tool input clusters; the resulting access-control policies are stored in a repository; and, at runtime, the policy enforcer intercepts each tool call and either allows or blocks it (Abaev et al., 15 Jan 2026).

Trace collection is performed by instrumenting the agent’s orchestration layer, for example via LiteLLM’s feedback hooks. The monitored events include the input prompt, internal thoughts or reasoning steps, and final output, including tool calls and their parameters. This instrumentation yields the raw material for both input-pattern learning and sequence reconstruction (Abaev et al., 15 Jan 2026).

From the observed benign sequences, the framework constructs a control-flow graph

$\mathcal{G}=(\mathcal{V},\mathcal{E}),$

where $\mathcal{V}$ is the set of tool-call nodes and $(u \to v)\in\mathcal{E}$ if $v$ follows $u$ in at least one benign sequence. The resulting graph acts as a runtime governance layer over agent orchestration: a call may be blocked not only because of its arguments, but because it appears at an illegitimate point in the trajectory (Abaev et al., 15 Jan 2026).

The runtime phase is described as lightweight. The policy enforcer is integrated below the agent’s logic through a hook, fetches the relevant per-tool policy and current CFG state for each proposed call, evaluates compliance, logs violations, and may notify the orchestrating LLM to abort or replan. The reported overhead is under 5% latency increase in end-to-end runs (Abaev et al., 15 Jan 2026).

3. Policy learning: embeddings, clustering, and rule induction

AgentGuardian’s policy learning pipeline combines feature extraction, clustering, and rule induction. For each tool-invocation event $x$ with associated numeric attributes $\mathcal{S}=\{S_1,\dots,S_M\}$0, the framework forms a 150-dimensional embedding $\mathcal{S}=\{S_1,\dots,S_M\}$1. The numeric attributes, scaled to $\mathcal{S}=\{S_1,\dots,S_M\}$2, are: max_input_tokens, max_output_tokens, min_hour, max_hour, max_idle_time, and max_processing_time, contributing 6 dimensions. The textual embeddings are: thoughts (32D), tool type (16D), tool input (64D), and task result (32D) (Abaev et al., 15 Jan 2026).

For each tool $\mathcal{S}=\{S_1,\dots,S_M\}$3, the embedded inputs are collected as

$\mathcal{S}=\{S_1,\dots,S_M\}$4

Clustering is then performed over $\mathcal{S}=\{S_1,\dots,S_M\}$5 to obtain clusters $\mathcal{S}=\{S_1,\dots,S_M\}$6 by minimizing within-cluster variance together with a penalty on rule complexity:

$\mathcal{S}=\{S_1,\dots,S_M\}$7

The paper notes hierarchical or $\mathcal{S}=\{S_1,\dots,S_M\}$8-means clustering as possible choices (Abaev et al., 15 Jan 2026).

Rule induction converts each cluster into an access predicate. Numeric attributes become interval constraints, while text inputs are generalized through an LLM-driven operator $\mathcal{S}=\{S_1,\dots,S_M\}$9:

$$S_i=\bigl\{T^n_{i,1},T^n_{i,2},\dots,T^n_{i,J_i}\bigr\}.$$0

These text constraints are conjoined with attribute ranges to form a tool-specific rule

$$S_i=\bigl\{T^n_{i,1},T^n_{i,2},\dots,T^n_{i,J_i}\bigr\}.$$1

The resulting policy for tool $$S_i=\bigl\{T^n_{i,1},T^n_{i,2},\dots,T^n_{i,J_i}\bigr\}.$$2 combines control-flow and input constraints:

$$S_i=\bigl\{T^n_{i,1},T^n_{i,2},\dots,T^n_{i,J_i}\bigr\}.$$3

At runtime, this becomes the decision predicate

$$S_i=\bigl\{T^n_{i,1},T^n_{i,2},\dots,T^n_{i,J_i}\bigr\}.$$4

This formulation makes AgentGuardian simultaneously an access-control system and a learned execution-governance system (Abaev et al., 15 Jan 2026).

4. Runtime enforcement and empirical evaluation

Runtime enforcement proceeds by intercepting each tool invocation, determining the current CFG state, retrieving the corresponding per-tool policy, and evaluating the policy in $$S_i=\bigl\{T^n_{i,1},T^n_{i,2},\dots,T^n_{i,J_i}\bigr\}.$$5 time. If the predicate holds, the call is allowed; otherwise it is blocked and an alert is raised. In critical settings, the paper notes that the agent may be terminated after a violation (Abaev et al., 15 Jan 2026).

The empirical study used two representative multi-agent applications with GPT-4.1 as the orchestration LLM: Knowledge Assistant, involving web discovery, file summarization, and emailing, and IT Support, involving diagnostics, remediation, and ticketing. Each application used 100 benign samples, of which 60 were used for staging and 40 for testing, together with 10 adversarial or misleading samples in the test set (Abaev et al., 15 Jan 2026).

Evaluation used three rates:

$$S_i=\bigl\{T^n_{i,1},T^n_{i,2},\dots,T^n_{i,J_i}\bigr\}.$$6

Per-application results were reported as follows: for Knowledge Assistant, $$S_i=\bigl\{T^n_{i,1},T^n_{i,2},\dots,T^n_{i,J_i}\bigr\}.$$7, $$S_i=\bigl\{T^n_{i,1},T^n_{i,2},\dots,T^n_{i,J_i}\bigr\}.$$8, and $$S_i=\bigl\{T^n_{i,1},T^n_{i,2},\dots,T^n_{i,J_i}\bigr\}.$$9, with 4 hallucinations; for IT Support, $\mathcal{D}$0, $\mathcal{D}$1, and $\mathcal{D}$2, with 2 hallucinations. Aggregated across both applications, the totals were $\mathcal{D}$3, $\mathcal{D}$4, and $\mathcal{D}$5 (Abaev et al., 15 Jan 2026).

The paper’s summary interpretation is that 18 of 20 policy violations were detected, false rejects remained low, and all hallucination-induced benign failures were correctly flagged as policy violations. The authors also state that the control-flow-based governance mechanism mitigates hallucination-driven errors and other orchestration-level malfunctions, which distinguishes the system from guards that operate only on argument values or prompt text (Abaev et al., 15 Jan 2026).

5. Relation to adjacent agent-guard frameworks

The name "AgentGuardian" also appears more broadly across recent agent-safety literature as a label for architectures that regulate tool use, monitor trajectories, verify policy adherence, or constrain runtime authority. These systems do not define a single unified method, but they collectively map out the design space within which AgentGuardian sits.

Framework	Core mechanism	Representative result
AgentGuardian	Learned context-aware access-control policies with CFG constraints	Aggregated $\mathcal{D}$6, $\mathcal{D}$7, $\mathcal{D}$8
GuardAgent	Plan-to-code guardrail agent with execution engine	Over 98% and 83% guardrail accuracies on EICU-AC and Mind2Web-SC
AGrail	Lifelong guardrail with adaptive safety-check generation and optimization	F1 98.4% on Mind2Web-SC; F1 97.8% on EICU-AC
AIRGuard	Runtime authority control with least-privilege enforcement	AgentTrap ASR 36.3% to 5.5%
BraveGuard	Trajectory-level guard training from open-world threat discovery	AgentHazard accuracy 38.79% to 82.38%
PolicyGuard	Dialogue-grounded verifier sub-agent with remediation	PASS4 improved by +12.0 / +6.0 / +12.0 pp
AgentRedGuard	Integration-aware classifier on tool-response content	Panel ASR 69.9% to 2.4% at 0.37% FPR

GuardAgent frames the guard as a separate reasoning agent that analyzes safety guard requests, produces a task plan, maps it into guardrail code, and executes that code to deterministically follow the guard request; it reports over 98% guardrail accuracy on EICU-AC and 83% on Mind2Web-SC (Xiang et al., 2024). AGrail instead emphasizes lifelong adaptation through a loop of safety-check generation, execution, and memory update, with reported F1 scores of 98.4% on Mind2Web-SC and 97.8% on EICU-AC (Luo et al., 17 Feb 2025).

AIRGuard shifts the focus from learned behavior models to runtime authority control. It treats the central failure mode as authority confusion, normalizes heterogeneous tool calls, derives step-level authority from task-level authority, tracks provenance and trust, and applies an enforcement cascade ranging from allow to block; on AgentTrap, it reduces Sonnet 4.6 attack success from 36.3% without defense to 5.5% (Qin et al., 27 May 2026). BraveGuard moves still further toward trajectory supervision: it mines open-world threats, synthesizes executable tasks, collects realistic rollouts, and trains trajectory-aware guards, with accuracy on AgentHazard increasing from 38.79% to 82.38% under the averaged guard-model setting (Feng et al., 31 May 2026).

PolicyGuard defines policy adherence as a dialogue-grounded verification problem rather than only a safeguard problem. Its verifier sub-agent shares the full conversation view, reasons over the policy and dialogue in context, and produces conversation-specific remediation; on $\mathcal{D}$9-BENCH airline, it improves PASS4 by +12.0 / +6.0 / +12.0 percentage points across GPT-5.4, Claude Sonnet 4.6, and Gemini 2.5 Pro (Kang et al., 28 Jun 2026). AgentRedGuard, by contrast, specializes in tool-response content across SaaS integrations, using a lightweight classifier inserted inline between the tool-calling client and the LLM agent; it reduces overall ASR from 69.9% to 2.4% at 0.37% false-positive rate (Dingeto et al., 1 Jun 2026).

Taken together, these systems indicate that "AgentGuardian" has become a broader research motif spanning learned access control, executable guardrails, lifelong check generation, authority-aware runtime mediation, trajectory-level threat detection, dialogue-grounded policy verification, and integration-aware content filtering. This suggests that the original AgentGuardian framework is best read not as an isolated design, but as one point in a rapidly diversifying guard architecture landscape.

6. Limitations, misconceptions, and open directions

The original AgentGuardian paper identifies several limitations. Rare but legitimate inputs may not appear during staging and can therefore be falsely rejected. Regex generalization may under- or over-approximate benign input families. Policy quality also depends on the underlying LLM’s consistency: smaller or misconfigured models produce lower-quality policies (Abaev et al., 15 Jan 2026).

A recurrent misconception in the area is that prompt-level or static filtering is sufficient for agent safety. Multiple systems in the surrounding literature explicitly argue otherwise. AgentGuardian itself was proposed because static guardrails and text-level filters cannot prevent malicious tool-call sequences or hallucination-driven misuse (Abaev et al., 15 Jan 2026). AIRGuard reports that a prompt-only variant reduces ASR only modestly, whereas runtime mediation cuts ASR further to 4% on DTAP-150 (Qin et al., 27 May 2026). BraveGuard states that harmful outcomes often emerge only through multi-step execution traces and that prompt-level classifiers miss outcomes visible only through multi-step composition (Feng et al., 31 May 2026).

A second misconception is that policy compliance can be reduced to single-call argument checking. PolicyGuard argues that real workflows unfold across many turns, require explicit user confirmation and prerequisite reads, and hinge on the content of the dialogue rather than on any single argument value (Kang et al., 28 Jun 2026). This does not invalidate AgentGuardian’s per-tool learned policies, but it does indicate that access control and dialogue-grounded verification address partially different failure modes.

The open directions listed for AgentGuardian include active learning from borderline rejects, adversarial-robust rule induction, extending CFG constraints to data-flow graphs, and formalizing policy learning as a multi-objective optimization over security, coverage, and complexity (Abaev et al., 15 Jan 2026). Related work broadens this agenda: runtime probabilistic assurance models emergent agent behavior as an online-updated MDP (Koohestani, 28 Sep 2025), verified-policy monitors separate exhaustive offline verification from lightweight online checking (Miculicich et al., 3 Oct 2025), and multimodal web guards demonstrate that prompt injection may require dedicated visual-textual reasoning rather than purely textual policy checks (Chen et al., 14 Apr 2026). These directions collectively indicate that future AgentGuardian-style systems will likely combine learned behavioral governance, explicit runtime mediation, richer temporal context, and stronger formal assurance.