Task-Centric Access Control Paradigms

• Task-Centric Access Control Paradigms are dynamic frameworks that assign permissions based on task-specific, temporally bounded activities.
• They employ multi-module architectures like TCAC, ACAC, and risk-adaptive TBAC to dynamically generate and revoke policies, minimizing security risks.
• These paradigms support autonomous systems and smart IoT environments by preventing data leakage and unsafe inter-task interactions through real-time policy enforcement.

Task-centric access control paradigms constitute a class of authorization models and enforcement architectures that shift from static, subject-centric frameworks (such as RBAC or ABAC) towards policies and mechanisms dynamically aligned with tasks, activities, and their context. These paradigms have arisen to address the needs of highly autonomous, collaborative, and dynamic environments—such as agentic systems, smart IoT ecosystems, and LLM-driven workflows—where static permission sets and role assignments are fundamentally insufficient to prevent data leakage, instruction injection, and unsafe cross-task interactions. Core developments include Task-Centric Access Control (TCAC), Activity-Centric Access Control (ACAC), risk-adaptive TBAC extensions, and context-driven models reshaping information governance and flow (Cai et al., 30 Oct 2025, Fleming et al., 13 Oct 2025, Li et al., 13 Oct 2025, Mawla et al., 2022, Gupta et al., 2021).

1. Formal Definitions and Foundational Elements

Task-centric models conceptualize access control via temporally and semantically bounded units—tasks or activities—rather than persistent privileges. The foundational TCAC model reflects this perspective:

• Task Set ($\mathcal{T}$): Distinguished, user-authorized tasks (e.g. “Register for App X”).
• Resource Set ($R$): Application data, external services, local files, etc.
• Operation Set ($O$): Granular actions (read, write, tap, text-entry).
• Context Set ($C$): Metadata-rich tuples, each indexed by a unique task-ID, including temporal bounds, targets, etc.

Policy rules are 4-tuples:

$$r = (\text{Agent}, r \in R, o \in O, c \in C) \mapsto \{\text{Allow}, \text{Deny}\}$$

A PolicySet $\Pi(c)$ for $c$ includes all rules explicitly scoped to context $c$.

In ACAC, the activity is central:

$$\text{act} = \langle \text{src}, \text{obj}, \text{op}, \sigma, \mu, \text{Attr} \rangle$$

with $\sigma$ marking the life-cycle state (Dormant, Started, Aborted, Hold, Continued, Finished); $\mu$ indicating duration or usage. Access decisions derive from evaluating authorizations, obligations, conditions, and inter-activity dependencies:

$$\text{allow(act)} = A(\text{act}) \wedge B(\text{act}) \wedge C(\text{act}) \wedge D(\text{act})$$

Table: Principal entities

Paradigm	Task/Activity Abstraction	Policy Scope
TCAC	TaskContext	Per-task, ephemeral
ACAC	Activity instance	Per-activity, mutable
TBAC	Task (extended w/ risk)	Per-task, risk-bound
AAC	Context vector/task	Multi-dimensional

2. Architectures and Enforcement Mechanisms

Modern task-centric paradigms typically deploy multi-module enforcement architectures:

• TCAC / AgentSentry (Cai et al., 30 Oct 2025): Interposes a Task Interpreter, Policy Generation Engine (PGE), Policy Enforcement Point (PEP), and Policy Decision Point (PDP) between the agent and the underlying OS. Every API call is intercepted, matched against active per-task policies, and subject to default-deny unless explicitly allowed. Policies are dynamically generated on task onset and revoked on completion, enforcing least-privilege and strict temporal bounds.
• ACAC (Mawla et al., 2022): Incorporates Attribute, Authorization, Obligation, Condition, and Dependency Engines. Every activity traverses a pipeline evaluating pre- and ongoing attribute states, environmental conditions, required obligations (such as biometric checks), and explicit inter-activity dependencies (ordering, concurrency, incompatibility). Enforcement points transition activity states according to accepted/denied requests, managing mutable activity attributes and supporting real-time revocation, hold, and resume events.
• Uncertainty-Aware TBAC (Fleming et al., 13 Oct 2025): Extends TBAC with a Task Authorization Service (TAS) invoking an LLM judge that synthesizes just-in-time policies, computes composite risk scores, and quantifies uncertainty. High-risk or high-uncertainty tasks trigger human-in-the-loop escalation; all actions and decisions are immutably logged.

3. Advanced Policy Generation and Adaptive Controls

Policy generation in task-centric paradigms is characterized by minimality and contextual precision:

• TCAC (Cai et al., 30 Oct 2025): The PGE references task-type templates, instantiates rules for only those operations and resources genuinely needed, disallowing broader access. Pseudocode reflects sequential resolution of resource specifications and required operations against contextual parameters. Policies are ephemeral—post-revocation, the agent reverts to default-deny.
• Risk-adaptive TBAC (Fleming et al., 13 Oct 2025): For each task, associated resources are scored according to business criticality. Composite risk is aggregated via maximum or weighted sum. Epistemic uncertainty (e.g., MC Dropout, ensemble disagreement) is computed to characterize the reliability of LLM-prompted policy synthesis, modulating auto-approval and escalation thresholds. The enforcement process involves synchronous capability token issuance valid only for the task lifetime.

Table: Policy generation—adaptive levers

Model	Minimality	Risk-Adaptivity	Temporal Scope
TCAC	Template-based	Not explicit	Task-bounded
TBAC+	LLM-synthesized	$\rho(s)$-dependent	Task-bounded
ACAC	Pre/post dependencies	Conditions, mutability	Activity-bounded

4. Information Flow and Multi-dimensional Context

Some paradigms expand beyond binary allow/deny decisions, governing the form and granularity of information disclosures:

• Agent Access Control (AAC) (Li et al., 13 Oct 2025): Adopts a two-stage model where a context vector

$$C = [c_\text{id}, c_\text{rel}, c_\text{scn}, c_\text{norm}]^\top$$

is computed scraping identity, relationships, scenario, and normative scores, weighted to yield a composite $S(C)$. Policy decisions span {allow, summarize, paraphrase, redact}, adaptively shaping the response to match context rather than statically admitting or rejecting. Underlying enforcement includes a lattice of confidentiality levels, with redaction/summarization downgrading the output to an allowed leakage level.

Contextual scoring and per-request policy recomputation allow task-centric paradigms to sustain nuanced, situation-aware governance over information flows—contrasted with role and attribute-centric models unable to enforce content-level modifications or maintain real-time compliance with norms.

5. Security Guarantees and Threat Models

Task-centric access control provides explicit mitigation against critical vulnerabilities endemic to legacy models—most notably, instruction/prompt injection and data exfiltration via agent hijacking:

• TCAC / AgentSentry (Cai et al., 30 Oct 2025): Demonstrated immunity to instruction injection attacks embedded in user content. Formal properties include task soundness (if execution occurs, it is explicitly permitted), least privilege (no privilege exceeding current policies), and strict policy temporality. In adversarial scenarios, all unauthorized operations are synchronously denied, with quantitative evidence of zero false-positives and total containment of malicious payloads.
• Risk-adaptive TBAC (Fleming et al., 13 Oct 2025): Ensures high-risk and uncertain tasks are blocked pending human review, limiting agentic misbehavior to the boundaries of approved capability tokens. Evaluation metrics include False Acceptance Rate (FAR), False Rejection Rate (FRR), analyst workload, and policy calibration against actual error rates.
• ACAC (Mawla et al., 2022, Gupta et al., 2021): Embeds real-time handling of obligations, mutable activity state, and inter-task dependencies; prevents hazardous task interleaving and supports continuous monitoring essential for Zero Trust deployments. Safety properties, coverage of incompatible activities, and reachability analyses remain core research focuses.

6. Practical Applications and Use-case Scenarios

Task-centric access control models have materialized in diverse settings:

• Autonomous Agents (mobile, desktop): TCAC frameworks such as AgentSentry enforce dynamic policy revocation, runtime mediation, and privilege minimization on LLM or GUI-driven agents (Cai et al., 30 Oct 2025).
• Enterprise Automation: LLM-driven TBAC supports ad-hoc task authorization (incident response, business analytics) with just-in-time policy adaptation (Fleming et al., 13 Oct 2025).
• Collaborative IoT/Smart Systems: ACAC governs interactions among distributed devices; scenarios include agricultural drone ordering, concurrency enforcement in greenhouse controls, and interlocked workflows in manufacturing and robotics (Mawla et al., 2022, Gupta et al., 2021).
• LLM-enabled Information Governance: AAC-powered agent systems compute context vectors per-request and adapt disclosure levels (summarization, redaction) as a regulatory and safety measure (Li et al., 13 Oct 2025).

7. Limitations, Open Challenges, and Future Directions

Task-centric paradigms entail nontrivial limitations and point to active research frontiers:

• Template Coverage and Policy Authoring: TCAC remains contingent on manually curated task templates, limiting coverage for novel or compound workflows.
• Multi-task Concurrency and Compound Policies: Most current implementations lack robust cross-task isolation or support for concurrent task orchestration; future directions include compound policy synthesis and session separation.
• Semantic Precision: Fine-grained intent inference (potentially LLM-driven) may yield more accurate resource and operation scoping.
• Formal Verification: Probabilistic models underlying context computation (e.g. AAC), LLM-judged TBAC, and dynamic ACAC pipelines lack robust formal leakage proofs and verification of noninterference in the presence of adversarial prompts and system faults.
• Scalability and Latency: Real-time per-request scoring, context embedding, and policy recomputation impose latency overheads; distributed enforcement architectures (edge/cloud) and hardware-backed enforcement are under investigation.
• Policy Language Development: ACAC explicitly calls for a domain-specific language supporting ordered, concurrent, and incompatible activities, constraint checking, and delegation mechanisms spanning multi-tenant CPS (Gupta et al., 2021).
• Zero Trust Convergence: ACAC aligns tightly with ZTA, continuously monitoring resources, dynamic session-based authorization, and attribute-driven principle-of-least-privilege (Mawla et al., 2022).

Task-centric access control paradigms have advanced the state of security modeling for autonomous, collaborative, and agentic systems. By dynamically aligning authorization with intent, context, and operational boundaries, they support resilient containment of emergent threats and fine-grained, adaptive information governance essential to future distributed autonomous platforms.