AuthorityLens: Rethinking LLM-Based Agent Systems Through the Lens of Authority
cs.AI
Submitted: 2026-09-26
Updated: 2026-09-26
Comments: 76 pages, 5 figures, including appendices
License: http://creativecommons.org/licenses/by/4.0/
The gist: LLM-based agents are increasingly deployed with authority over consequential resources and decisions in real systems.
Terminology
Abstract
LLM-based agents are increasingly deployed with authority over consequential resources and decisions in real systems. These agents often operate alongside human and LLM-based participants who hold different forms of authority. Yet workflow roles, permission settings, and review mechanisms do not necessarily reflect the authority realized in practice. We introduce AuthorityLens, a framework for measuring a system's authority structure. Starting from an authority portfolio, we evaluate a system along three dimensions: what the system is authorized to do (System Authority), how much joint participation is required to exercise that authority (Authority Separation), and how much authority each participant holds (Principal Authority). We derive these measurements from the minimal combinations of participants sufficient to realize each outcome across admissible runtime states. We apply AuthorityLens to Codex, OpenCode, and Gemini CLI across 13 operating configurations over a common portfolio of agent operations. We find that nominal configurations do not map cleanly onto realized authority. In Codex, Full Access changes System Authority only marginally while substantially concentrating authority in the executing Assistant. OpenCode's Build and Plan configurations have the same System Authority and Authority Separation despite different workflows and root-level permissions. In Gemini CLI, model-based review increases Authority Separation without changing System Authority. Principal Authority further distinguishes authority replication from authority separation: spawned or delegated agents can become alternative holders of the same authority without increasing the required joint participation. Together, these results demonstrate that AuthorityLens provides a unified framework for measuring and comparing realized authority structures across agent systems.
Sources
- Defeating Prompt Injections by Design
- Magentic-One: A Generalist Multi-Agent System for Solving Complex Tasks
- Defending Against Indirect Prompt Injection Attacks With Spotlighting
- Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework
- Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions
- Prompt Infection: LLM-to-LLM Prompt Injection within Multi-Agent Systems
- We Urgently Need Privilege Management in MCP: A Measurement of API Usage in MCP Ecosystems
- Progent: Securing AI Agents with Privilege Control
- When Lower Privileges Suffice: Investigating Over-Privileged Tool Selection in LLM Agents
- NetSafe: Exploring the Topological Safety of Multi-agent Networks
- MiniScope: Authorizing Agents with Least-Privilege Permissions
- Capability Gates Are Not Authorization: Confused-Deputy Failures in LLM Agent Frameworks
Related papers
- MAVEN-T: Reinforced Heterogeneous Distillation for Real-Time Multi-Agent Trajectory Prediction
- Model Discovery Agent: LLM-assisted Bayesian experiment design for data-efficient discovery of mechanistic world models
- Agents' Last Exam
- The Clinician's Veto: Navigating Trust, Liability, and Uncertainty in Autonomous AI Prescribing
- MindHelper: Closed-Loop Embodied Mental-State Reasoning for Precision Intervention
- Incumbent Advantage: Brand Bias and Cognitive Manipulation Dynamics in LLM Recommendation Systems