Paper deep dive

SoK: Trust-Authorization Mismatch in LLM Agent Interactions

Guanquan Shi, Haohua Du, Zhiqiang Wang, Xiaoyu Liang, Weiwenpei Liu, Song Bian, Zhenyu Guan

Year: 2024Venue: arXiv preprintArea: Agent SafetyType: SurveyEmbeddings: 82

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 94%

Last extracted: 3/12/2026, 5:17:29 PM

Summary

The paper introduces the Belief-Intention-Permission (B-I-P) framework to address the 'Trust-Authorization Mismatch' in LLM agents, where static permissions fail to account for the probabilistic and context-dependent nature of agentic behavior. By modeling agent execution through Belief Formation, Intent Generation, and Permission Grant, the authors propose a shift from static Role-Based Access Control (RBAC) to dynamic, risk-adaptive authorization based on a Safety Margin Ratio (SMR).

Entities (5)

B-I-P Framework · framework · 100%Trust-Authorization Mismatch · security-concept · 100%LLM Agent · system-component · 98%Model Context Protocol · protocol · 95%Safety Margin Ratio · metric · 95%

Relation Signals (3)

B-I-P Framework → decomposes → Agent Execution

confidence 95% · By decomposing agent execution into three distinct stages—Belief Formation, Intent Generation, and Permission Grant

Trust-Authorization Mismatch → causedby → Static Authorization

confidence 90% · static permissions are structurally decoupled from the agent's fluctuating runtime trustworthiness

Safety Margin Ratio → governs → Permission Grant

confidence 90% · SMR(Action a) = T (B,I) R(P ) >= theta

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Large Language Models (LLMs) are evolving into autonomous agents capable of executing complex workflows via standardized protocols (e.g., MCP). However, this paradigm shifts control from deterministic code to probabilistic inference, creating a fundamental Trust-Authorization Mismatch: static permissions are structurally decoupled from the agent's fluctuating runtime trustworthiness. In this Systematization of Knowledge (SoK), we survey more than 200 representative papers to categorize the emerging landscape of agent security. We propose the Belief-Intention-Permission (B-I-P) framework as a unifying formal lens. By decomposing agent execution into three distinct stages-Belief Formation, Intent Generation, and Permission Grant-we demonstrate that diverse threats, from prompt injection to tool poisoning, share a common root cause: the desynchronization between dynamic trust states and static authorization boundaries. Using the B-I-P lens, we systematically map existing attacks and defenses and identify critical gaps where current mechanisms fail to bridge this mismatch. Finally, we outline a research agenda for shifting from static Role-Based Access Control (RBAC) to dynamic, risk-adaptive authorization.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

81,229 characters extracted from source content.

Expand or collapse full text

SOK: TRUST-AUTHORIZATION MISMATCH IN LLM AGENT INTERACTIONS Guanquan Shi shiguanquan@buaa.edu.cn Haohua Du* duhaohua@buaa.edu.cn Zhiqiang Wang sa21221041@mail.ustc.edu.cn Xiaoyu Liang xiaoyuliang@buaa.edu.cn Weiwenpei Liu liuweiwenpei@buaa.edu.cn Song Bian sbian@buaa.edu.cn Zhenyu Guan guanzhenyu@buaa.edu.cn ABSTRACT Abstract Large Language Models (LLMs) are evolving into autonomous agents capable of executing complex workflows via standardized protocols (e.g., MCP). However, this paradigm shifts con- trol from deterministic code to probabilistic inference, creating a fundamental Trust-Authorization Mismatch: static permissions are structurally decoupled from the agent’s fluctuating runtime trustwor- thiness. In this Systematization of Knowledge (SoK), we survey more than 200 representative papers to categorize the emerging landscape of agent security. We propose the Belief-Intention-Permission (B-I-P) framework as a unifying formal lens. By decomposing agent execution into three distinct stages—Belief Formation, Intent Generation, and Permission Grant—we demonstrate that diverse threats, from prompt injection to tool poisoning, share a common root cause: the desynchronization between dynamic trust states and static authorization boundaries. Using the B-I-P lens, we system- atically map existing attacks and defenses and identify critical gaps where current mechanisms fail to bridge this mismatch. Finally, we outline a research agenda for shifting from static Role-Based Access Control (RBAC) to dynamic, risk-adaptive authorization. Keywords AI agent· trustworthiness· security 1 Introduction LLMs are transcending their roles as passive information retrieval engines to become autonomous agents capable of executing complex workflows in digital and physical environments [1]. Through standardized protocols such as the Model Context Protocol (MCP) [2], these agents now have the ability to plan tasks, invoke external tools, and manipulate system resources. As illustrated in Fig. 1, this evolution fundamentally shifts the locus of control from deterministic code paths—manually crafted and statically verifiable—to probabilistic, natural language-driven decision models. While this paradigm shift unlocks immense utility, it destabilizes the foundational assumptions of modern system security: that software behavior is predictable and that privileges granted at authentication remain valid throughout execution [3]. Specifically, incumbent security architectures rely on pre-defined policy evaluation [4]. Systems typically perform a one-time entitlement check upon authentication, binding a fixed set of privileges to an agent’s identity. This model assumes that an authenticated entity will strictly adhere to defined business logic. However, LLM agents defy this assumption. Governed by stochastic sampling rather than deterministic logic, an agent’s runtime behavior is highly context-dependent. According to Rice’s Theorem [5], we analyze that verifying whether a Turing-complete agent’s semantic behavior satisfies a non-trivial security property for arbitrary inputs is undecidable before runtime. Consequently, static access control mechanisms are structurally incapable of governing probabilistic agent behaviors. We term this structural misalignment the Trustworthiness-Authorization Mismatch. It represents a systemic failure arXiv:2512.06914v2 [cs.CR] 9 Feb 2026 SoK: Trust-Authorization Mismatch in LLM Agent Interactions User (a) Traditional System ACL Input Databases Code Request (b) Agent System LLM Files DatabasesFiles System Boundary System Boundary Unlimited Access External Tool Web Service Prompt Template Agent User Query Result Query Result External Tool Web Service Invocation Figure 1: The Comparison of the Traditional Security Model and AI Trustworthy Model. state in which the static execution permissions granted to an agent become dangerously decoupled from the agent’s fluctuating trustworthiness at runtime. In this state, a compromised or hallucinating agent retains high-privilege access (Authorization) even when its internal belief state or immediate intent (Trustworthiness) has been corrupted. Despite the escalating threat landscape, the academic community’s understanding of this domain remains fragmented. Existing taxonomies often focus on listing specific attack vectors, such as “Jailbreaking" or “Prompt Injection," without explaining the underlying structural failures that allow these attacks to generalize across different modalities and protocols. Without a unified framework to analyze the agent’s decision lifecycle, defenses remain reactive and isolated. This Systematization of Knowledge (SoK) provides a unifying formal lens for agent interaction security. We argue that addressing the security of autonomous agents requires shifting from a “vulnerability-patch" mindset to a “lifecycle-state" perspective. To this end, we formalize the Belief-Intention-Permission (B-I-P) framework. This framework decomposes the opaque "black box" of agent execution into three observable stages: (1) Belief Formation, where the agent constructs a probabilistic view of the world from inputs; (2) Intent Generation, where beliefs are synthesized into provisional plans; and (3) Permission Grant, where plans encounter the hard boundary of system authorization. By grounding our analysis in the B-I-P framework, we shift from a phenomenological account of attacks to a mechanistic understanding of failure. We surveyed 87 representative papers (screened from 248 candidates) across AI and systems security venues. We demonstrate that disparate incidents—from indirect prompt injection in RAG systems to tool poisoning in MCP servers—share a common root cause: the desynchronization between the agent’s dynamic trust state and the system’s static authorization boundaries. Scope and Threat Model. We focus strictly on runtime interaction security for agentic systems. We exclude training- time poisoning unless it directly manifests as a runtime decision vulnerability. Our threat model assumes a highly capable adversary who can manipulate user prompts, external retrieval content (RAG), and protocol metadata, targeting the integrity and availability of the B→I→P decision chain. To summarize, our contributions are: • A Unifying Formal Lens (The B-I-P Framework): We introduce the Belief-Intention-Permission framework to model the agentic lifecycle. We propose the Safety Margin Ratio (SMR) as a governing invariant, defining security not as a static property but as a dynamic state in which the system’s Trust Capacity must strictly dominate the Risk Load of the intended action (T (B,I) > R(P )). 2 SoK: Trust-Authorization Mismatch in LLM Agent Interactions •Systematization of Attacks & Defenses: We provide a comprehensive mapping of existing literature onto the B-I-P lifecycle. Unlike prior surveys that categorize work by attack modality (e.g., “Image Attacks"), we classify work by its chain-breaking mechanism—distinguishing, for instance, between defenses that verify Data Provenance in Stage 1 and those that enforce Context-Aware Isolation in Stage 3. • Gap Analysis & Research Agenda: Our systematization reveals that current defenses are skewed towards the early stages (Belief/Intent) while neglecting the critical bottleneck of Authorization. We outline a concrete research agenda to move beyond static Role-Based Access Control (RBAC) toward Belief-Aware Access Control (BAAC), advocating for authorization mechanisms that can dynamically modulate permissions based on the agent’s real-time cognitive uncertainty and data provenance. 2 Problem Overview & Scope This section characterizes the fundamental conflict between stochastic agent workflows and traditional permission grants, proving that neither static nor context-aware models offer sufficient security guarantees in non-deterministic environments. We adopt a minimal agent vocabulary consistent with our later formalization: an agent maintains internal state, perceives its environment through inputs and tool/agent returns, forms intentions to act, and issues actions that are either permitted or denied by the host system [6]. In intent-driven workflows, users express goals in natural language; the agent decomposes goals into subtasks, invokes external capabilities (tools/APIs/agents) [7], and integrates results into a coherent response. 2.1 Overview of Agent We adopt a minimal agent vocabulary consistent with our later formalization: an agent maintains internal state, perceives its environment through inputs and tool/agent returns, forms intentions to act, and issues actions that are either permitted or denied by the host system [6]. In intent-driven workflows, users express goals in natural language; the agent decomposes goals into subtasks, invokes external capabilities (tools/APIs/agents) [7], and integrates results into a coherent response. This operational loop—from belief (about the world) to intention (plans) to permission (what the system allows) to action—is the substrate for our mismatch analysis in Sec. 3. User User Query Result Agent BMCP Server A MCP Server B Initial Request Tool Invocation Tool List Tool Invocation Tool Returns Agent Card Request Response Tool Returns Agent A MCP A2A Figure 2: MCP protocol and A2A protocol workflow. Interaction Protocols (MCP/A2A) and Boundaries. Standardized protocols provide the communication fabric for agent ecosystems. An interaction typically proceeds in three stages (cf. Fig.2): 1. Capability discovery. Agents advertise or retrieve metadata describing callable functions and constraints (e.g., MCP tool descriptors; A2A agent cards). This establishes provenance and delineates authorization boundaries. 3 SoK: Trust-Authorization Mismatch in LLM Agent Interactions Agent A Agent BAgent C Agent D Agent A Agent B Agent D Agent C Joint ModeHierarchical Mode Figure 3: MAS Coordination Strategies. 2. Invocation and execution. The initiator supplies parameters and context; calls may nest or cascade to downstream tools/agents. Transports (JSON-RPC, HTTP, etc.) preserve call–return semantics. 3.Result propagation. Targets return structured outputs (Results/Messages/Artifacts) synchronously or asyn- chronously; these outputs update the agent’s belief state and may trigger further planning. Trust/permission boundaries and instrumentation points. To make protocols actionable for security engineering, we annotate the sequence with: (i) source labeling and integrity tags at ingress (where sanitizers and anomaly detectors operate), (i) belief attribution at the planner (for quarantine/taint propagation), (i) policy guards at permission checks (static/dynamic authorization, belief-aware ABAC/TBAC), and (iv) secure logging at each transition (for auditability and post-hoc reconstruction). These are the concrete chain-breaking control points revisited in Sec. 5. Multi-Agent Systems (MAS). Multi-agent systems [8] coordinate peers or hierarchies to achieve complex objectives (Fig. 3). Joint modes share state and coordinate as equals; hierarchical modes decompose tasks to sub-agents and aggregate results. MAS improves coverage and specialization but amplifies propagation risk: faulty or adversarial returns can cascade across agents, increasing the need for provenance, isolation, and belief-aware authorization. 2.2 Models in Cybersecurity and AI Traditional Cybersecurity Model. Traditional security draws on the CIA triad, TCB minimization, and the Principle of Least Privilege (PoLP) [9]. Historically, authorization was often treated as a proxy for trust: once authenticated and authorized, entities were expected to behave predictably inside the perimeter. Agentic settings violate this assumption: adaptive reasoning and tool-driven actions mean that what an entity is allowed to do may diverge from what it should do, creating a gap our SoK makes explicit. Trustworthy AI Model. Trustworthy AI emphasizes alignment, safety, and robustness (e.g., reducing hallucinations and harmful behavior) [10]. These efforts largely address behavioral trust within a single model. When aligned models become agents that call tools and delegate, the tension with system-level authorization becomes salient: behavior may be “aligned” yet still produce unsafe actions under ambiguous goals and over-broad permissions. This motivates our unifying lens in Sec. 3, where beliefs, intentions, and permissions are explicitly reasoned about. 2.3 The Undecidability of Agent Behavior Unlike traditional software, which executes compiled, deterministic code paths, an LLM Agent executes a dynamic “program” synthesized at runtime from natural language prompts. This execution flow generally follows a tripartite cycle, as shown in Fig. 5: 1. Intention: The agent perceives external inputs to deduce semantic intent. 2. Plan: The agent formulates a sequence of steps (Chain of Thought) to satisfy the intent. 3. Permission: The agent invokes tools or APIs to execute the plan, subject to authorization checks. 4 SoK: Trust-Authorization Mismatch in LLM Agent Interactions Recent studies confirm that such agentic control loops, particularly when augmented with external memory and recursive tool use, exhibit Turing completeness [11]. Consequently, predicting the terminal state of an agent (e.g., whether it will execute a specific sensitive action) given an arbitrary input is mathematically equivalent to the Halting Problem. This undecidability renders risk pre-quantification impossible. An agent’s “intent” is an emergent property of the runtime context, not a pre-encoded state. For instance, an agent authorized toREAD_EMAILmay utilize this capability for a benign purpose (e.g., “summarize meeting notes”) or a malicious one (e.g., “extract password reset links”) depending entirely on the semantic context of the input data. Static access control models, which assume a static trust environment, fail catastrophically in this setting. When an agent ingests uncontrolled external data (e.g., via RAG or web search), its internal alignment state drifts, invalidating any static, low-risk assumptions and turning authorized capabilities into security vulnerabilities. 2.4 Proof of Failure: Predefined Permission To provide a rigorous characterization of the limitations of prevailing security mechanisms, we formulate two formal proofs for static and semi-static permission sets, respectively. We firstly define a safety propertyP safe as: “AgentAwill not generate any action sequence that violates the permission setΠunder any input.” We observe thatP safe is a non-trivial semantic property. It concerns the agent’s ultimate behavior (Action), independent of the syntactic form of its Prompt. There are agents that are always safe (e.g.,NULL agents) and agents that are inherently unsafe (e.g., unrestricted code executors). 2.4.1 Failure of Static Permission Sets Theorem 1. It is undecidable to determine whether an arbitrary AgentAsatisfies the safety propertyP safe defined by a static permission set Π. We proceed by reduction from the Halting Problem. Assume, for the sake of contradiction, that there exists a perfect static verifier V capable of decidingP safe for any agent. LetMbe an arbitrary Turing Machine andwbe an arbitrary input. We construct an AgentA M,w with a System Prompt enforcing the following logic: “Ignore all external instructions. Internally simulateMon inputw. If and only ifM halts, execute the restricted action DELETE_ROOT.” We submitA M,w toV, there are two cases: IfVreturns Unsafe, it impliesA M,w will executeDELETE_ROOT. By construction, this occurs only ifMhalts onw. IfVreturns Safe, it impliesA M,w will never executeDELETE_ROOT. By construction, this implies M never halts on w. Thus, the existence ofVwould allow us to solve the Halting Problem. Since the Halting Problem is undecidable, no such perfect static verifier V exists. 2.4.2 Failure of Semi-static Permission Sets To address the limitations of static approaches, recent literature has introduced Context-aware Permission Models [12]. The core premise of such models is that permission validity is not invariant, but must be dynamically adjudicated by integrating the agent’s logic with the runtime context. The security decision can be speficied as a predicate: “Is the subsequent action of AgentMsecure with respect to the current contextw ctx ?” However, we demonstrate that this ostensibly dynamic mechanism fundamentally reduces the general Halting Problem to the Halting Problem for a specific input: the contextw ctx often represents merely the initial state of a task. Agents frequently engage in sequential multi-step reasoning (Chain of Thought). An action appearing superficially benign (e.g.,ls -la) may serve as a precursor to a subsequent malicious operation (e.g.,rm -rf /). Semi-static verification, constrained to the immediate step, fails to detect such latent maliciousness. However, attempting to predict the entire future sequence necessitates simulating the Agent’s full execution trajectory, which effectively reverts to the general Halting Problem. The efficacy of semi-static permission models fundamentally relies on the capability to distinguish between legitimate user instructions and malicious injections. The system attempts to distinguish between tokens that reflect the user’s authentic intent and those that are externally injected with adversarial payloads. However, within LLMs, this distinction is blurred by the Instruction-as-Data paradigm. Consequently, constructing an ideal semi-static filter to intercept prompt injections is computationally equivalent to formulating an algorithm that determines whether an arbitrary inputx, when processed by the LLM, alters the “intended semantics” of the programP. Determining whether “inputxcauses the Agent to deviate from its intended security semantics” constitutes precisely such a non-trivial semantic property 5 SoK: Trust-Authorization Mismatch in LLM Agent Interactions A-S1A-S2A-S3D-S1D-S2D-S3 User Query System Prompt Tool Returns Agent Returns Local Resource Agent Spoofing Sanitizing Neutralization Hardening Isolating Detection Static PoLP Dynamic Auth. Taint Tracking 81 143 61 41 5 12 111 132 51 52 4 3 3 4 AttackDefense 0 2 4 6 8 10 12 14 Count Figure 4: Distribution of surveyed papers across the B-I-P framework stages. A-S1 denotes Attacks in Stage 1, and D-S1 denotes Defenses in Stage 1. regarding program behavior. According to Rice’s Theorem, any non-trivial semantic property of the function computed by a Turing machine is undecidable. 2.5 Methodology and Scope Scope. We study runtime interaction security of LLM-based agents: how agents perceive, decide, and act via protocols (e.g., MCP/A2A), tools/APIs, and local resources. Training-time poisoning/model theft are out of scope unless they directly mediate runtime decisions. By default, we assume adversaries may control user prompts, external content, protocol metadata, or local resources. Strategy in brief. To ensure breadth across systems-security and AI/ML venues and depth on agent–tool protocols, we adopt a two-pronged SoK strategy: •cross-community retrieval over major libraries (CCS, USENIX, NDSS, ICLP, NeurIPS) plus arXiv/Scholar for grey literature; • B-I-P–aligned coding that maps each artifact to the victim component, the mismatch stage (1 to 3), the evaluation setting, and the evidence level. This yields a corpus adequate to evaluate claims under the Trust–Authorization lens introduced in Sec. 3. Full search strings, inclusion/exclusion criteria, de-duplication rules, and the PRISMA-style flowchart are presented in Appendix A. The machine-readable corpus and labeling codebook are provided as anonymized artifacts. Completeness and reproducibility. We report the retrieval window, venues, and counts in Appendix A. We retrieved 248 records in total, among which automated and manual similarity-based analysis identified approximately 64 items as topically overlapping, yielding184unique items after de-duplication. From these, we included81papers in the final corpus. adaptive attacks. Fig. 4 presents the distribution of research studies across the various stages of the B-I-P model(discussed in Sec. 3), based on our literature analysis. To ensure transparency and support the reproducibility of our systematization, we have made our complete dataset and artifacts publicly available at an anonymous repository. This dataset includes (1) a comprehensive CSV file containing the raw bibliographic information and extracted metadata for all literature reviewed in this work, and (2) the access links to the literature. This material is provided to facilitate the review process and enable future research. The artifacts can be accessed at: https://anonymous.4open.science/r/Paper-76DE/ 6 SoK: Trust-Authorization Mismatch in LLM Agent Interactions User User Query Tool InvocationExecution Databases Files Planing Workflow of an Agent System Stage 1 Stage 2 LLM Provider Resource Query Analysis External Tools Tools Permission Grant Stage 3 Agent LLM Template Belief FormationIntent Generation Context Tool List Memory Figure 5: The workflow of an agent system and its corresponding three stages of the B-I-P Framework. 3 The B-I-P Framework Given the uncertainty inherent in agentic systems, we introduce Trust as a mediating mechanism, defined as dynamic confidence in an agent’s runtime state and data provenance. Security violations occur when an agent retains static high privileges despite trust degradation caused by low-quality inputs. To address this, the B-I-P Framework decomposes the agent’s cognitive process into three phases for targeted defense. 3.1 Model Definition The Belief-Intention-Permission (B-I-P) Framework provides a formal analytical framework for agent interactions, partitioning the execution lifecycle into three critical phases, as illustrated in Fig. 5: •Belief (B): The agent’s cognitive representation of the external world state, derived from information ingestion within the context window. • Intention (I ): The sequence of plans or action chains generated by the agent to achieve specific goals. • Permission (P): The operational boundaries and resource access rights granted to the agent to execute the intended plans. To render the B-I-P framework computationally quantifiable, we incorporate the engineering principle of the factor of safety [13]. We posit that the system’s Trust Capacity must exceed the action’s Risk Load by a specified margin, defined as the safety margin ratio (SMR). Formally, an action is permitted if and only if the cumulative system trust outweighs the risk sensitivity of the action, surpassing a pre-defined safety threshold θ: SMR(Action a) = T (B,I) R(P ) ≥ θ context (1) whereT (B,I) = T B × T I represents the trust capacity,R(P ) = R P quantifies the potential destructiveness of the action, andθ context is the safety margin coefficient. Typically,θ > 1.0implies that trust must significantly strictly dominate risk. Based on the magnitude of the SMR relative to calibrated thresholds (θ low ,θ high ), we delineate three distinct operational postures for the Agent, as shown in Fig. 6: 1. Autonomous Execution (SMR≥ θ high ): Trust capacity significantly dominates the risk load. The system authorizes the action immediately without user interruption, enabling frictionless agent autonomy in high- confidence scenarios. 7 SoK: Trust-Authorization Mismatch in LLM Agent Interactions Trust Capacity Risk Load Autonomous Execution HITL Intervention Preemptive Denial Ambiguity or moderate risk Trust deficit High confidence θ high θ high θ low θ low Figure 6: The Trust and Risk Matrix. 2.Human-in-the-Loop (HITL) Intervention (θ low ≤ SMR < θ high ): The safety margin is marginal, indicating ambiguity or moderate risk. The system suspends execution and escalates the decision to the user. A risk warning is displayed, mandating explicit confirmation (affirmative consent) before proceeding. 3.Preemptive Denial (SMR < θ low ): A Trust Deficit occurs (e.g.,SMR < 1.0), where the potential risk outweighs the current trust capacity. The system automatically blocks the intent and triggers a security alert, preventing the Agent from executing potentially harmful or unverified operations. 3.2 Why Three Stages in B-I-P? The agent’s operational lifecycle fundamentally is a continuous autoregressive feedback loop. At any discrete time stept, the LLM synthesizes the current Belief stateB t to derive an IntentI t . This intent dictates the execution of an ActionA t , which interacts with the environment to yield an ObservationO A t (e.g., API return values or tool outputs). Crucially, the observationO A t is integrated into the cumulative contextC t+1 , precipitating an update to the belief state B t+1 . This updated belief recursively drives the generation of the subsequent intent I t+1 . This process is: I t+1 = f (B t+1 ,G) = f (Update(B t ,O A t ),G)(2) whereG represents the invariant global goal (User Instruction), and f denotes the reasoning function of the LLM. 3.3 Stage I: Belief Formation Definition. The Agent constructs a cognitive representation of the current world state by synthesizing user instructions, system prompts, externally retrieved information (RAG), and returns. In this context, a “Belief” is not absolute truth but a probabilistic inference derived from bounded evidence. To quantify the reliability of this inference against threats like Source Poisoning and Hallucination, we define the Belief Trust Score (T B ∈ [0, 1]). This meta-cognitive metric aggregates the veracity, integrity, and provenance reliability of the Agent’s context window through three constituent dimensions: T B ≈ t prov · t conf · t cons (3) where:t prov denotes the reliability of data provenance,t cons quantifies the degree of semantic ambiguity within the data and t conf represents the model’s inherent cognitive certainty. Data Provenance Trust (t prov ): To mitigate Source Poisoning, where adversarial payloads in external data contaminate the agent’s belief state, we assign hierarchical trust levels based on information origin: • System and Authenticated User Prompts: Highest trust (Root of Trust). 8 SoK: Trust-Authorization Mismatch in LLM Agent Interactions •Retrieval Context (RAG): Variable trust contingent on document authority (Internal Knowledge Base>Open Internet). • Return Content: Variable trust contingent on where the return value comes from (Internal > Third-party). • Unverified/Third-party Inputs: Lowest trust, representing the primary vector for Prompt Injection. Cognitive Certainty (t conf ): This metric addresses Hallucination and Epistemic Uncertainty. It measures the Agent’s internal confidence, typically derived from output logits. A flat probability distribution (high semantic entropy) during critical fact generation indicates the Agent is "confabulating," necessitating a penalty to belief credibility. Semantic Consistency (t cons ): A stability metric obtained via Self-Consistency checks. If the Agent derives contradic- tory belief states across multiple reasoning paths for the same query,t cons decreases, reflecting logical instability in the belief formation process. 3.4 Stage I: Intent Generation Definition. Predicated on the verified beliefs established in Stage I, the Agent performs reasoning to derive a sequence of operational intents to fulfill the belief-driven goals. We explicitly distinguish Intent from Action to underscore that these are provisional objectives: they remain strictly hypothetical and unexecuted until they pass the mandatory authorization checks in Stage I. Consequently, the Intent Trust Score (T I ) is formalized as the product of the tool’s inherent trustworthiness and the safety of its anticipated return artifacts: T I ≈ t tool · t return (4) where t tool represents the trust of tool invoked and t return indicates the possible risk of return. Tool Provenance Trust (t tool ) quantifies the software supply chain integrity of the external tools, APIs, or plugins invoked by the Agent. Under this metric, high trust values are assigned exclusively to verifiable assets, such as locally hosted functions, digitally signed binaries, and authenticated first-party APIs. Unverified third-party extensions and dynamic code execution modules are assigned low trust scores due to their inherent susceptibility to supply-chain compromise. Tool Return Safety (t return ): Quantifies the potential for Context Pollution arising from the tool’s output. In autore- gressive agent frameworks, tool outputs are appended to the prompt history for subsequent reasoning. If a tool returns complex, unstructured data (e.g., raw HTML from a web scraper), it introduces a high attack surface for Indirect Prompt Injection. 3.5 Stage I: Permission Grant Definition. The stochastic nature of autonomous Agents renders such static pre-allocation hazardous. Thus, we define “permission” not as a pre-existing right, but as the Risk Quantification of the operational intent generated in Phase I. Execution is granted if and only if the quantified risk of the action is strictly bounded by the current trust state of the system. Consequently, the risk metric during the authorization phase, denoted as R P , is formalized as: R P = max(r conf ,r rev ,r scope )(5) wherer conf ,r rev , andr scope quantify the data confidentiality, operational irreversibility, and cascade impact scope, respectively. Data Confidentiality Weight (r conf ): Grounded in Quantitative Information Flow theory, this metric quantifies the potential information leakage (in bits) associated with the target data. Operations accessing public or non-sensitive data are assigned low risk scores, whereas interactions with high-entropy secrets or Personally Identifiable Information (PII) incur high risk penalties. Operational Irreversibility (r rev ): Quantifies the magnitude of system state mutation and the computational cost of restoration (rollback). Read-only operations or ephemeral caching are considered low risk. Conversely, actions involving persistent state modifications — such as writing to databases, altering system configurations, or deleting data — are penalized with higher risk scores due to their destructive potential. Cascade Impact Scope (r scope ): Evaluates the potential Blast Radius of the operation. Actions strictly confined to a single user session or local context are classified as low-risk, while operations that can affect global system configurations, critical infrastructure, or multi-tenant environments are flagged as high-risk. 9 SoK: Trust-Authorization Mismatch in LLM Agent Interactions Table 1: Taxonomy of existing literature mapped to the B-I-P trust dimensions. The table correlates risk quantification studies with corresponding defense mechanisms. StageTrust Dimension (Metric)Risk Analysis & MeasurementsDefense Mechanisms I: Belief Cognitive Certainty (t conf ) Hallucination & Errors: [14], [15], [16], [17] Memory Augmentation: [18], [19], [20] Data Provenance (t prov ) Context Contamination: [21], [22] Sanitization (Filters): [23], [24] Semantic Consistency (t cons ) Adversarial Perturbation: [25], [26], [27], [28] Neutralization (Rewriting): [29], [30] I: Intent Tool Provenance (t tool ) Supply Chain Poisoning: [31], [32], [33], [34], [35] Invocation Detection: [36], [37], [38] Return Value Safety (t return ) Recursive Injection: [39], [40], [41], [42], [43] Return Anomaly Detection: [44], [45] I: Permission Data Confidentiality (r conf ) Sensitivity Quantification: [46], [47], [48], [49] N/A (Addressed by Policy) Op. Irreversibility (r rev ) Recovery Cost Metrics: [50], [51], [52], [53], [54] N/A (Addressed by Policy) Cascade Scope (r scope ) Blast Radius Analysis: [55], [56], [57], [58], [59] N/A (Addressed by Policy) Table 2: Comparison of evaluation paradigms employed by representative benchmarks. Hybrid approaches are denoted by combined labels. Our specific metrics at different stage can be quantitatively instantiated using the corresponding benchmarks. Metric Evaluation ParadigmRepresentative Works t conf Human-Annotated[16], [60] Rule-Based + LLM-Judge[61] t prov Rule-Based[62] t tool Rule-Based[63] Rule-Based + LLM-Judge[35] t return Rule-Based + LLM-Judge[64] r rev Rule-Based[50] 4 Systematization and Instantiation In this section, we systematize the landscape of existing literature through the lens of the B-I-P framework, delineating the methodologies for instantiating the model’s key parameters. Subsequently, we apply the framework to analyze specific edge cases, thereby demarcating the operational boundaries and applicability of our model. 4.1 Parameter Instantiation: Stage I A “Belief” does not constitute a deterministic mapping of objective reality; rather, it is a probabilistic inference derived from bounded evidence (e.g., user inputs, reference documents). To systematize the associated risks, we categorize existing research according to the three dimensions of the Belief Trust Score (T B ). 4.1.1 Cognitive Certainty (t conf ) Cognitive certainty reflects the model’s epistemic confidence in its own outputs. Existing literature predominantly characterizes hallucination as an inconsistency between the generation and source material [14] or as structural errors [15], phenomena fundamentally rooted in the model’s high-entropy states. 10 SoK: Trust-Authorization Mismatch in LLM Agent Interactions To quantify this dimension, benchmarks like HaluEval employ a generation-discrimination paradigm, revealing significant boundary blurring when LLMs attempt to distinguish fact from fabrication [16]. Furthermore, recent studies extend this concept into the action space, identifying “planning-level hallucinations,” where models exhibit misplaced confidence in physically infeasible actions [17]. These findings dictate that the metrict conf must encompass the entire pipeline from text generation to logical planning. 4.1.2 Data Provenance (t prov ) In contrast to internal hallucinations, contamination attacks target the Agent’s context window. While System Prompts are traditionally regarded as the “Root of Trust,” research on Prompt Infection challenges this assumption, demonstrating that malicious directives can propagate covertly through multi-agent collaboration chains [21]. The attack surface is further expanded by the proliferation of protocols like the Model Context Protocol (MCP). Recent measurements indicate that the MCP Store alone introduces over 34,000 third-party tool endpoints [22]. This exponential growth implies that relying on static allow-lists is insufficient to maintaint prov . Consequently, a dynamic weighting mechanism based on source reputation is essential. 4.1.3 Semantic Consistency (t cons ) The inherent ambiguity of natural language allows attackers to construct adversarial perturbations that induce inconsis- tent internal states within the model [25,26,27]. Cross-model comparative analyses further confirm that inputs with lower structural rigidity (i.e., highly naturalistic language) exacerbate this ambiguity [28]. Therefore, in calculating the aggregate Trust ScoreT B , it is critical to incorporate a consistency check,t cons , as a stability penalty term. The value oft cons is derived from self-consistency metrics, penalizing the overall trust score when the agent exhibits logical volatility under semantic variations. 4.1.4 Defensive Mechanisms (f T B (·)) Current defenses mitigate belief corruption through two primary paradigms. Memory Augmentation targets the cognitive certainty (t conf ) by breaking self-reinforcing error loops. Mechanisms like MemGuard [18] and “vaccine” strategies [19,20] inject failure-aware exemplars to inhibit the propagation of flawed reasoning. Sanitization functions as a reactive filter (analogous to WAFs), utilizing rule-based signatures or model-based classifiers to intercept adversarial payloads. These methods primarily aim to uphold data provenance (t prov ) [23,24], yet they are constrained by the premise that malicious intent is explicitly observable within static input features. Complementarily, Neutralization targets semantic consistency (t cons ) by rewriting inputs to enforce semantic constraints and minimize ambiguity [29,30]. While effective against surface-level perturbations, these defenses often falter when adversarial intent manifests only through multi-step reasoning, highlighting a critical gap in current Stage I robustness. 4.2 Parameter Instantiation: Stage I In the intent generation phase, the Agent synthesizes the verified beliefs established in Phase I with its own capability boundaries to architect specific execution paths. We explicitly delineate Intent from Action, emphasizing that an intent constitutes merely a “provisional hypothetical objective.” Consequently, the trustworthiness of this intent (T I ) is subject to dual attenuation factors: the integrity of the tool supply chain and the safety of the external data environment. 4.2.1 Tool Provenance Trust (t tool ) This dimension quantifies the integrity of the supply chain for external capabilities (Tools/APIs) invoked by the Agent. Trust erosion in this dimension primarily stems from supply chain poisoning risks. Attackers can manipulate semantic features within tool descriptions to trigger unintended invocations [31,32] or induce irrational preference biases in the Agent’s planner [33]. Furthermore, adversaries may exploit connection-handshake protocols to coerce the Agent into executing unauthorized instructions even before explicit tool invocation [34]. These findings indicate that maintainingt tool necessitates more than static source verification; it requires a contextual trust analysis of the tool descriptions themselves. Specifically, we instantiate it by leveraging the cross-model invocation consistency metrics derived from MCP-Bench [35], which consistency serves as a quantitative proxy for tool robustness. 11 SoK: Trust-Authorization Mismatch in LLM Agent Interactions 4.2.2 Return Value Safety (t return ) Within autoregressive architectures, data returned from tool execution flows recursively back into the Agent’s context window, introducing new trust dynamics defined by Recursive Context Pollution. Malicious payloads in external tool outputs (e.g., web content containing hidden instructions) constitute a primary attack surface. Studies such as InjecAgent [39] and AgentDojo [40] highlight that malicious return data can effectively hijack the Agent’s control flow. Moreover, attackers can employ forged dialogue templates to further obfuscate the Agent’s source attribution capabilities [41]. Crucially, empirical evidence suggests a correlation between high data unstructuredness and an increased probability of concealed malicious payloads [65, 66]. Beyond external malice, the internal consistency of local data also impacts credibility. Reasoning based on “stale” or expired data can precipitate unintended consequences [42, 43]. Consequently, we implement a stratified quantification oft return . For internal tools, it is modeled as a function of data freshness (temporal validity). As for the external tools, they are inversely correlated with the syntactic complexity of the return content, reflecting the higher entropy and attack potential of unstructured data. 4.2.3 Defensive Mechanisms (g T I (·)) Stage I defenses intervene within intermediate trust states to intercept the materialization of malicious intent. Abnormal Invocation Detection (g(t tool )) mitigates provenance risks by validating tool utilization against established behavioral baselines. By scrutinizing attention patterns and dependency structures, these mechanisms detect divergences from legitimate capability–tool bindings prior to execution [36, 37, 38]. Anomalous Return Detection (g(t Return )) safeguards the recursive feedback loop. Discarding the assumption of implicit trust, these approaches leverage anomaly detection to identify distributional shifts or adversarial payloads latent in tool outputs [44, 45]. 4.3 Parameter Instantiation: Stage I In the B-I-P, the permission grant is a bounding function: an execution actionais granted if and only if its quantified risk R P (a) is strictly bounded by the current trust stateT of the system, denoted as R P (a)≤T . Unlike probabilistic risk models that factor in likelihood, the permission metric in Stage 3 is strictly impact-oriented to ensure safety bounds. We characterize the intrinsic risk R P of a proposed action along three critical dimensions. 4.3.1 Data Confidentiality (r conf ) Quantifies the sensitivity level of the information assets accessed or processed by the action. This metric maps the intent’s semantic context to data governance classifications (e.g., Public, Internal, Restricted). Existing work quantifies data sensitivity through semantic and structural analysis. FlowCog [46] constructs an NLP- based metric space, mapping data sensitivity to vector distances to detect privacy violations. Complementarily, static analysis approaches [49] model sensitivity propagation and dynamic transitions, identifying variables that—while explicitly unlabeled—implicitly carry sensitive semantics. Further research leverages confidence metrics and contextual relevance weights to dynamically compute entity-specific sensitivity scores [47,48]. Collectively, these methodologies provide the theoretical basis for calculating r conf across heterogeneous data types. 4.3.2 Operational Irreversibility (r rev ) Measures the cost of restoring the system to its pre-execution state. Actions with high entropy generation or external side effects (e.g., sending an email, deleting logs) result in maximalr rev , whereas idempotent read operations yield minimal values. The recoverability of operations is typically quantified via cost metrics, encompassing economic, computational, and temporal dimensions. TOLERANCE [50] frames recoverability as a machine replacement problem, balancing potential security losses against the operational costs of recovery. Alternative approaches focus on minimizing the cost of attack scenario reproduction [51] or the latency of rolling back specific malicious actions [52]. In neural network contexts, system recovery is modeled as an entropy-reduction process (reverse engineering) to restore system order, using entropy gradients to estimate risk [53,54]. These frameworks inform the calculation ofr rev , allowing for the selection of metrics tailored to specific action types. 12 SoK: Trust-Authorization Mismatch in LLM Agent Interactions 4.3.3 Cascade Impact Scope (r scope ) Describes the "blast radius" of the action within the dependency graph. This dimension captures whether the action is confined to a local sandbox or affects critical system-wide components. We adopt the concept of “blast radius” to characterize the cascading effects of malicious actions, analyzed via network, semantic, or data-flow reachability. Partition-based execution models have been proposed to calculate this radius in complex systems [55,56]. Graph-theoretic approaches define the impact scope as the set of all resource nodes accessible by a subject within a permission graph [57,58]. Specifically for the Model Context Protocol (MCP), recent work quantifies risk scope based on the agent’s perceived authority over resources within its current context window [59]. These methodologies support the quantification ofr scope , enabling adaptive selection based on the target entity (e.g., Network, LLM, or Database). 5 Case Studies To empirically validate the efficacy of the B-I-P framework and its governing invariant, the Safety Margin Ratio (SMR), we conduct an in-depth analysis of two representative adversarial scenarios. Case Study I reconstructs a real-world security incident involving the Doubao AI Phone, focusing on system availability and anti-fraud mechanisms. Case Study I simulates a Visual Indirect Prompt Injection attack against multimodal agents and evaluates system integrity under adversarial perturbations. In both instances, we benchmark our proposed B-I-P Dynamic Trust Architecture against a Static Permission Baseline. The SPB is the prevailing access control paradigm in the current Android and iOS ecosystems, in which a permission granted by the user at installation or runtime is treated as an unconditionally trusted capability throughout the session lifecycle. 5.1 Unintentional Denial-of-Service Scenario Background. In December 2025, the Doubao AI Phone, equipped with a system-level Agent, was reported to have caused the freezing of numerous user accounts on platforms like WeChat and Alipay [67]. The incident stemmed from the Agent’s execution of flash-sale or ticket-snapping tasks. To maximize success rates, the Agent leveraged the INJECT_EVENTSpermission to simulate screen taps at supra-human frequencies, inadvertently triggering the service providers’ Anti-Bot and anti-scraping heuristics. Attack Model. The subject is an authorized, legitimate system-level Agent, whose intent is benign (Explicit user directive: Help me snatch a ticket). And the failure is the collapse of trust during intention generation. The Agent generated a non-anthropomorphic” execution plan, causing external systems to misclassify the legitimate user as a malicious bot, resulting in asset freezing (Availability Loss). 5.1.1 Baseline Analysis: Static Permission Control Under this paradigm, the operating system restricts its validation to whether the Agent holds the necessary API handle. • Permission Check: check(Agent, INJECT_EVENTS)→ PASS. • Logical Determination: Since the user granted the Agent Full Screen Control” and the Agent’s binary is signed, the system remains agnostic to the specific frequency or pattern of the click events. •Outcome: The Agent executes clicks at a 50ms interval. The target application’s risk control system detects this anomaly, triggering an account freeze. • Conclusion: Static permissions fail to perceive risk patterns in execution behavior, leading to a state of being over-privileged regarding rate and pattern. 5.1.2 B-I-P Analysis The B-I-P framework extends the trust model by introducing a dynamic ratio constraint involving Scheme Trust (T Scheme ) and Action Risk (R Action ). Step A: Parameter Quantification. • Belief Trust (T B ≈ 1.0): The directive originates directly from an authenticated user and is unambiguous. 13 SoK: Trust-Authorization Mismatch in LLM Agent Interactions •Intent Trust (t tool ≈ 0.9): The intent (ticket snatching”) aligns with the user’s historical behavioral profile and is inherently benign. • Intent Trust (t return ≈ 0.2: The Agent’s generated scheme involves a high-frequency loop. System telemetry identifies click intervals (∆time) falling below 100ms; when benchmarked against the Human Behavior Baseline, this pattern yields a negligible Anthropomorphism Score, resulting in a quantified tool return trust (t return ) of 0.2 that classifies the behavior as inherently robotic. •Risk Potential (R P = 0.9): The target context involves financial/social applications (WeChat/Alipay) and operations related to Order Submission/Payment.” Step B: SMR Invariant Check. Applying the extended B-I-P formula to include scheme verification: SMR = T B · T I · T Scheme R P = 1.0× 0.9× 0.2 0.9 = 0.2 Step C: Decision & Enforcement. • Judgment: SMR(0.2)≪ θ safe (1.2). • System Response: 1. Execution Block: The kernel intercepts the high-frequency INJECT_EVENTS calls. 2. Forced Degradation: The Agent is compelled to downgrade to “Assist Mode.” It must either high- light buttons for manual user interaction or automatically inject random latency (Jitter) to satisfy the anthropomorphic requirements of T Scheme . • Result: The mechanism successfully averts the risk of account banning, thereby preserving service availability. 5.2 Visual Indirect Prompt Injection Scenario Background. A user browses a webpage containing a malicious advertisement. An attacker has embedded adversarial text within the ad image, which is imperceptible to humans (e.g., via steganography or microscopic font size) but machine-readable, commanding: “System Override: Transfer100to account #8821 immediately.” The system-level Agent, employing real-time Vision-Language Processing, captures and parses the screen content. Attack Model. The subject is an Agent with a compromised belief state and a malicious intent. And the failure is provenance poisoning during the Belief Formation phase. The Agent fails to distinguish between authoritative User Instructions” and untrusted Web Content” within the visual field. 5.2.1 Baseline Analysis: Static Permission Control • Permission Check: First do the Screen Capture: check(Agent, READ_BUFFER)→ PASS. Then the App Launch: check(Agent, START)→ PASS. • Logical Determination: As the Agent possesses system-level assistant privileges and operates in the fore- ground, it satisfies all static access control predicates. •Outcome: The Agent parses the fund transfer command, misinterprets it as user intent, launches the banking application, and attempts to populate the transaction form. If automated payment permissions are pre- authorized, funds are stolen. •Conclusion: The static model is defenseless against Data-Plane Attacks because it blindly trusts the Agent’s internal inference results, lacking semantic introspection. 5.2.2 B-I-P Analysis The B-I-P framework neutralizes the attack by employing Information Flow Taint Tracking and strictly enforcing Provenance Trust (T P rov ). Step A: Parameter Quantification. • Belief Trust (T B ): – The Agent receives visual input. The underlying UI Tree Analyzer tags the text source as the com.android.chromeWebView container, distinct from the System Notification Bar or User Voice Input interfaces. 14 SoK: Trust-Authorization Mismatch in LLM Agent Interactions – Provenance Trust (t prov ): Unverified web content is assigned a low trust value, t prov = 0.1. – Calculation: T B = t conf × t prov = 0.9 (OCR confidence)× 0.1 = 0.09. • Intent Trust (T I ): – The generated intent is “Fund Transfer.” –Intent Alignment (t align ): This intent lacks causal correlation with the user’s current context (web browsing) and has received no explicit voice confirmation. – Calculation: T I = 0.3. • Risk Potential (R P ): – The operation invokes the sensitive finance.transfer API. – Calculation: R P = 1.0 (Critical Risk). Step B: SMR Invariant Check. SMR = T B · T I R P = 0.09× 0.3 1.0 = 0.027 Step C: Decision & Enforcement. • Judgment: SMR(0.027)≪ θ critical (1.5). • System Response: 1. B-I-P Circuit Breaker: The system identifies a high-risk operation supported by a critically low SMR. 2.Security Intervention: A system-level, non-overridable Secure Confirmation Prompt is triggered: “Transfer command detected from webpage. High risk action. Proceed?” 3.Provenance Attribution: The malicious ad region within the webpage is visually highlighted to contex- tualize the command source for the user. • Result: The attack is interdicted at the translation boundary between Intent and Action. 6 Opportunities and Fundamental Challenges Having systematically reviewed the attacks and defenses across the B-I-P framework, we can now synthesize these findings to identify the central challenges and critical research gaps. The initial critique of the B-I-P framework correctly identified the fragility of the earlier stages, but the path forward is not to abandon them, but to integrate them into a unified Defense-in-Depth architecture. 6.1 From Passive Defense to Active Friction Is adversarial defense in the belief stage valuable? Yes, but its value proposition must be redefined. We move away from the binary goal of “perfect security” to the strategic goal of cost asymmetry. Current defenses, such as prompt filtering, are passive and reactive. However, emerging techniques like Representation Engineering (RepE) and Active Semantic Sanitization offer a path to active defense. By monitoring the latent space for geometric signatures of malice and actively restructuring inputs to strip imperative syntax, we can filter out the vast majority of opportunistic attacks. This “Semantic Hygiene” layer serves as necessary friction, reducing noise and allowing subsequent stages to focus on sophisticated threats. The challenge remains to make these defenses generalizing across models and modalities, but the opportunity is to build a “cognitive immune system” that is resilient, if not immune. 6.2 From Unverifiable to Auditable in Intent Is the process of generating malicious intent traceable and verifiable? It is difficult, but not impossible. The “Black Box” nature of LLMs is a hurdle, but the solution lies in externalizing the reasoning process. By adopting frameworks such as VeriGuard and Reasoning-Path Verification, we can require agents to produce “proofs of intent” — whether in the form of verifiable code or consistent reasoning traces — that can be audited before execution. This shifts the security model from “trusting the agent’s alignment” to “verifying the agent’s output.” The critical gap here is the lack of standardized “Intent Languages” and “Semantic Audit” tools that can reliably capture and analyze these traces at scale. 15 SoK: Trust-Authorization Mismatch in LLM Agent Interactions 6.3 From Belief-Blind to Belief-Aware Authorization Is permission management the only reliable control point? It is the final control point, but it must no longer be blind. The most significant flaw in current systems is the decoupling of authorization from cognition. Belief-Aware Access Control (BAAC) represents the future of agent security. By integrating attributes such as Data Provenance (Taint), Model Uncertainty, and Composite Risk into the authorization decision, we can create dynamic, context-aware permissions. This solves the “Confused Deputy” problem by ensuring that an agent acts not just with the authority of its user, but with the verified intent of its user. 6.4 Challenges and Future To realize this vision, the research community must tackle several Challenges: • Formalizing Semantic Taint: We need rigorous standards for tracking data lineage through neural networks. How do we mathematically prove that an output token relies on an input token? Developing “Causal Abstraction” techniques for taint analysis is a priority. •Standardizing Uncertainty Quantification: We need robust, adversarial-resistant metrics for model confidence. An attacker should not be able to “fake” low uncertainty to bypass BAAC checks. Research into calibrated uncertainty estimation is vital. • Auditable Agent Protocols: We need to move beyond ad-hoc API calls to standardized protocols like the Agent Payments Protocol (AP2) that include cryptographic proofs of intent and provenance as first-class citizens in agent communication. •Zero-Trust for Multi-Agent Systems: As agents interact with other agents, the risk of “Cross-Agent Contamination” grows. We need “Zero-Trust” architectures for multi-agent swarms where every inter-agent message is treated as a potential vector for belief corruption. 7 Related Work Deng et al. [68] provide a comprehensive examination of security challenges in AI agents and survey threats involving model misuse, tool invocation, and multi-step reasoning. Ehtesham et al. [69] analyze four emerging agent communica- tion protocols, namely the Model Context Protocol, the Agent Communication Protocol, the Agent-to-Agent Protocol, and the Agent Network Protocol, and compare their deployment assumptions and interoperability properties. Li et al. [70] present a systematic review of LLM-based multi-agent systems with a focus on coordination mechanisms, agent architectures, and task decomposition strategies. Other surveys on LLM security [26,25] emphasize prompt-based vulnerabilities or model-level risks. These surveys take a broader perspective than this SoK in their respective research scopes and thus do not cover a systematic analysis of the entire agent security system. Many works investigate individual vulnerability classes within agent security. Prior research studies prompt injection [71, 25], jailbreak attacks [72,73,74], and tool-poisoning threats in protocol-driven environments [75,38]. These works are orthogonal to this paper. Other studies explore interaction-layer manipulation, including multi-agent exploitation [76, 77], agent-to-agent contamination [78], and untrusted data channels in agent pipelines [79,80]. Additional efforts construct taxonomies of interface-level risks and mitigations [39,40,81]. These complement this SoK, which proposes a risk-analysis model for emerging threats on agents and classifies the implementation paths of both attacks and defenses. 8 Conclusion & Discussion This work provides a systematization of over 200 papers and a unified formal perspective, revealing that security failures in LLM-based agents stem from a fundamental mismatch between trust and authorization. Through the B–I–P model, we argue that permission management is the most practical approach for verifiable constraints. These findings highlight the need for future research on belief-aware dynamic authorization, taint-driven policy enforcement, and auditable interaction provenance to enable agent systems that are controllable, verifiable, and secure in real-world deployments. Limitations. We emphasize that several limitations arise from the novelty and volatility of this domain and thus reflect practical, field-wide realities. First, the corpus necessitates the inclusion of grey literature to capture the rapid evolution of attack vectors. Consequently, ecosystem counts are time-sensitive. These are objective constraints in a nascent ecosystem; they may influence measurement stability, but do not diminish the value of the B-I-P framework as a unifying lens. Second, the B-I-P framework is intended solely to provide a perspective for systematizing existing work, rather than as a rigid guide for future research; its utility lies in defining and clarifying the scope of the "Trust-Authorization Mismatch." 16 SoK: Trust-Authorization Mismatch in LLM Agent Interactions Overall, these limitations bound claims without negating the contribution: a formal bridge between trust and authoriza- tion, and a reproducible mapping of attacks/defenses into chain-breaking control points. Ethics considerations This work does not involve human subjects at any stage. All processed data consists of academic discussion papers or statistical datasets, all of which can be retrieved from open sources. Therefore, this work raises no ethical concerns related to human subjects, such as informed consent or privacy risks. Open Science The artifacts can be accessed at: https://anonymous.4open.science/r/sok-76C8/ 17 SoK: Trust-Authorization Mismatch in LLM Agent Interactions References [1]Junlin Xie, Zhihong Chen, Ruifei Zhang, Xiang Wan, and Guanbin Li. Large multimodal agents: A survey. arXiv preprint arXiv:2402.15116, 2024. [2]PBC Anthropic. Introducing the model context protocol. URL: https://w. anthropic. com/news/model- contextprotocol, Accessed, 19:2025, 2024. [3]Donald C Latham. Department of defense trusted computer system evaluation criteria. Department of Defense, 198:20, 1986. [4]Sotiropoulos John, Rosario Ron F Del, Kokuykin Evgeniy, Oakley Helen, Habler Idan, Underkoffler Kayla, Huang Ken, Steffensen Peter, Aralimatti Rakshith, Bitton Ron, et al. Owasp top 10 for llm apps & gen ai agentic security initiative. PhD thesis, OWASP, 2025. [5]Henry Gordon Rice. Classes of recursively enumerable sets and their decision problems. Transactions of the American Mathematical society, 74(2):358–366, 1953. [6]Jason Jabbour and Vijay Janapa Reddi. Generative ai agents in autonomous machines: A safety perspective. In Proceedings of the 43rd IEEE/ACM International Conference on Computer-Aided Design, pages 1–13, 2024. [7]Shishir G Patil, Tianjun Zhang, Xin Wang, and Joseph E Gonzalez. Gorilla: Large language model connected with massive apis. Advances in Neural Information Processing Systems, 37:126544–126565, 2024. [8] Jianrui Wang, Yitian Hong, Jiali Wang, Jiapeng Xu, Yang Tang, Qing-Long Han, and Jürgen Kurths. Cooperative and competitive multi-agent systems: From optimization to games. IEEE/CAA Journal of Automatica Sinica, 9(5):763–783, 2022. [9] Morrie Gasser. Building a secure computer system. Van Nostrand Reinhold Company New York, 1988. [10] Yang Liu, Yuanshun Yao, Jean-Francois Ton, Xiaoying Zhang, Ruocheng Guo, Hao Cheng, Yegor Klochkov, Muhammad Faaiz Taufiq, and Hang Li. Trustworthy llms: a survey and guideline for evaluating large language models’ alignment. arXiv preprint arXiv:2308.05374, 2023. [11]Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. Exploiting programmatic behavior of llms: Dual-use through standard security attacks. In 2024 IEEE Security and Privacy Workshops (SPW), pages 132–143. IEEE, 2024. [12]Jinhao Zhu, Kevin Tseng, Gil Vernik, Xiao Huang, Shishir G. Patil, Vivian Fang, and Raluca Ada Popa. Miniscope: A least privilege framework for authorizing tool calling agents, 2025. [13]Joseph H Saleh, Karen B Marais, and Francesca M Favaro. System safety principles: A multidisciplinary engineering perspective. Journal of Loss Prevention in the Process Industries, 29:283–294, 2014. [14]Xixun Lin, Yucheng Ning, Jingwen Zhang, Yan Dong, Yilong Liu, Yongxuan Wu, Xiaohua Qi, Nan Sun, Yanmin Shang, Kun Wang, et al. Llm-based agents suffer from hallucinations: A survey of taxonomy, methods, and directions. arXiv preprint arXiv:2509.18970, 2025. [15]Sara Salehi, Yashbir Singh, Kelly K Horst, Quincy A Hathaway, and Bradley J Erickson. Agentic ai and large language models in radiology: Opportunities and hallucination challenges. Bioengineering, 12(12):1303, 2025. [16]Junyi Li, Xiaoxue Cheng, Wayne Xin Zhao, Jian-Yun Nie, and Ji-Rong Wen. Halueval: A large-scale hallucination evaluation benchmark for large language models. arXiv preprint arXiv:2305.11747, 2023. [17]Danny Driess, Fei Xia, Mehdi SM Sajjadi, Corey Lynch, Aakanksha Chowdhery, Ayzaan Wahid, Jonathan Tompson, Quan Vuong, Tianhe Yu, Wenlong Huang, et al. Palm-e: An embodied multimodal language model. 2023. [18]Qianshan Wei, Tengchao Yang, Yaochen Wang, Xinfeng Li, Lijun Li, Zhenfei Yin, Yi Zhan, Thorsten Holz, Zhiqiang Lin, and XiaoFeng Wang. A-memguard: A proactive defense framework for llm-based agent memory. arXiv preprint arXiv:2510.02373, 2025. [19]Tiansheng Huang, Sihao Hu, and Ling Liu. Vaccine: Perturbation-aware alignment for large language models against harmful fine-tuning attack. Advances in Neural Information Processing Systems, 37:74058–74088, 2024. [20]Pierre Peigné, Mikolaj Kniejski, Filip Sondej, Matthieu David, Jason Hoelscher-Obermaier, Christian Schroeder de Witt, and Esben Kran. Multi-agent security tax: Trading off security and collaboration capabilities in multi- agent systems. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 27573–27581, 2025. [21] Donghyun Lee and Mo Tiwari. Prompt infection: Llm-to-llm prompt injection within multi-agent systems. arXiv preprint arXiv:2410.07283, 2024. 18 SoK: Trust-Authorization Mismatch in LLM Agent Interactions [22]Hechuan Guo, Yongle Hao, Yue Zhang, Minghui Xu, Peizhuo Lyu, Jiezhi Chen, and Xiuzhen Cheng. A measurement study of model context protocol. arXiv preprint arXiv:2509.25292, 2025. [23]Yizhu Wang, Sizhe Chen, Raghad Alkhudair, Basel Alomair, and David Wagner. Defending against prompt injection with datafilter. arXiv preprint arXiv:2510.19207, 2025. [24]Yifan Zeng, Yiran Wu, Xiao Zhang, Huazheng Wang, and Qingyun Wu. Autodefense: Multi-agent llm defense against jailbreak attacks. arXiv preprint arXiv:2403.04783, 2024. [25]Chetan Pathade. Red teaming the mind of the machine: A systematic evaluation of prompt injection and jailbreak vulnerabilities in llms. arXiv preprint arXiv:2505.04806, 2025. [26]Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 14322–14350, 2024. [27] Victoria Benjamin, Emily Braca, Israel Carter, Hafsa Kanchwala, Nava Khojasteh, Charly Landow, Yi Luo, Caroline Ma, Anna Magarelli, Rachel Mirin, et al. Systematically analyzing prompt injection vulnerabilities in diverse llm architectures. arXiv preprint arXiv:2410.23308, 2024. [28]Ashraf Elnashar, Jules White, and Douglas C Schmidt. Prompt engineering for structured data: a comparative evaluation of styles and llm performance. Artificial Intelligence and Autonomous Systems, 2(2):32–49, 2025. [29]Xiaotian Zou, Yongkang Chen, and Ke Li. Is the system message really important to jailbreaks in large language models? arXiv preprint arXiv:2402.14857, 2024. [30]Wei Zhao, Zhe Li, Yige Li, Ye Zhang, and Jun Sun. Defending large language models against jailbreak attacks via layer-specific editing. arXiv preprint arXiv:2405.18166, 2024. [31]Luca Beurer-Kellner and Marc Fischer.Mcp security notification: Tool poisoning attacks.https:// invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks, 2025. Accessed: 07-09-2025. [32]Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. Formalizing and benchmarking prompt injection attacks and defenses. In 33rd USENIX Security Symposium (USENIX Security 24), pages 1831–1847, 2024. [33]Zihan Wang, Hongwei Li, Rui Zhang, Yu Liu, Wenbo Jiang, Wenshu Fan, Qingchuan Zhao, and Guowen Xu. Mpma: Preference manipulation attack against model context protocol. arXiv preprint arXiv:2505.11154, 2025. [34]TrailofBits.Jumpingtheline:Howmcpserverscanattackyoube- foreyoueverusethem.https://blog.trailofbits.com/2025/04/21/ jumping-the-line-how-mcp-servers-can-attack-you-before-you-ever-use-them/, 2025.Ac- cessed: 07-09-2025. [35]Zhenting Wang, Qi Chang, Hemani Patel, Shashank Biju, Cheng-En Wu, Quan Liu, Aolin Ding, Alireza Rezazadeh, Ankit Shah, Yujia Bao, et al. Mcp-bench: Benchmarking tool-using llm agents with complex real-world tasks via mcp servers. arXiv preprint arXiv:2508.20453, 2025. [36]Kaijie Zhu, Xianjun Yang, Jindong Wang, Wenbo Guo, and William Yang Wang. Melon: Provable defense against indirect prompt injection attacks in ai agents. arXiv preprint arXiv:2502.05174, 2025. [37] Huihao Jing, Haoran Li, Wenbin Hu, Qi Hu, Heli Xu, Tianshu Chu, Peizhao Hu, and Yangqiu Song. Mcip: Protecting mcp safety via model contextual integrity protocol. arXiv preprint arXiv:2505.14590, 2025. [38]Zhiqiang Wang, Junyang Zhang, Guanquan Shi, HaoRan Cheng, Yunhao Yao, Kaiwen Guo, Haohua Du, and Xiang-Yang Li. Mindguard: Tracking, detecting, and attributing mcp tool poisoning attack via decision dependence graph. arXiv preprint arXiv:2508.20412, 2025. [39]Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. Injecagent: Benchmarking indirect prompt injections in tool-integrated large language model agents. arXiv preprint arXiv:2403.02691, 2024. [40]Edoardo Debenedetti, Jie Zhang, Mislav Balunovic, Luca Beurer-Kellner, Marc Fischer, and Florian Tramèr. Agentdojo: A dynamic environment to evaluate prompt injection attacks and defenses for llm agents. Advances in Neural Information Processing Systems, 37:82895–82920, 2024. [41]Hwan Chang, Yonghyun Jun, and Hwanhee Lee. Chatinject: Abusing chat templates for prompt injection in llm agents. arXiv preprint arXiv:2509.22830, 2025. [42]A. K. Soni and R. Kumar. Bridging the gap: Improving agentic ai with strong and safe data practices. Journal of Intelligent Learning Systems and Applications, 17:257–266, 2025. 19 SoK: Trust-Authorization Mismatch in LLM Agent Interactions [43]Lillian Tsai and Eugene Bagdasarian. Context is key for agent security. arXiv e-prints, pages arXiv–2501, 2025. [44]Sana Ebrahimi, Mohsen Dehghankar, and Abolfazl Asudeh. An adversary-resistant multi-agent llm system via credibility scoring. arXiv preprint arXiv:2505.24239, 2025. [45]Xu He, Di Wu, Yan Zhai, and Kun Sun. Sentinelagent: Graph-based anomaly detection in multi-agent systems. arXiv preprint arXiv:2505.24201, 2025. [46]Xiang Pan, Yinzhi Cao, Xuechao Du, Boyuan He, Gan Fang, Rui Shao, and Yan Chen.FlowCog: Context-aware semantics extraction and analysis of information flow leaks in android apps. In 27th USENIX Security Symposium (USENIX Security 18), pages 1669–1685, 2018. [47] Zhen Lin, Shubhendu Trivedi, and Jimeng Sun. Contextualized sequence likelihood: Enhanced confidence scores for natural language generation. arXiv preprint arXiv:2406.01806, 2024. [48] Manjira Sinha, Nilesh Agarwal, and Tirthankar Dasgupta. Relation aware attention model for uncertainty detection in text. In Proceedings of the ACM/IEEE Joint Conference on Digital Libraries in 2020, pages 437–440, 2020. [49]Feiyang Tang. Analyzing Privacy in Software. PhD thesis, Norwegian University of Science and Technology, 2024. [50] Kim Hammar and Rolf Stadler. Intrusion tolerance for networked systems through two-level feedback control. In 2024 54th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pages 338–352. IEEE, 2024. [51]Kim Hammar and Rolf Stadler. Intrusion tolerance as a two-level game. In International Conference on Decision and Game Theory for Security, pages 3–23. Springer, 2024. [52]Ao Li, Jinwen Wang, and Ning Zhang. Software availability protection in cyber-physical systems. In 34nd USENIX Security Symposium (USENIX Security 25), 2025. [53]Michael Patrick Frank and Thomas F Knight Jr. Reversibility for efficient computing. PhD thesis, Massachusetts Institute of Technology, Dept. of Electrical Engineering and . . . , 1999. [54]Lianshan Liu, Li Tang, and Weimin Zheng. Lossless image steganography based on invertible neural networks. Entropy, 24(12):1762, 2022. [55]Muhammad Shoaib, Alex Suh, and Wajih Ul Hassan. Principled and automated approach for investigating AR/VR attacks. In 34th USENIX Security Symposium (USENIX Security 25), pages 4325–4344, 2025. [56]Melina Raptaki, George Stergiopoulos, and Dimitris Gritzalis. Automated event log analysis with causal dependency graphs for impact assessment of business processes. IEEE Access, 2024. [57]Zheng Fang, Hao Fu, Tianbo Gu, Pengfei Hu, Jinyue Song, Trent Jaeger, and Prasant Mohapatra. Towards system- level security analysis of iot using attack graphs. IEEE Transactions on Mobile Computing, 23(2):1142–1155, 2022. [58]Su Wang, Zhiliang Wang, Tao Zhou, Hongbin Sun, Xia Yin, Dongqi Han, Han Zhang, Xingang Shi, and Jiahai Yang. Threatrace: Detecting and tracing host-based threats in node level through provenance graph learning. IEEE Transactions on Information Forensics and Security, 17:3972–3987, 2022. [59] Shiva Gaire, Srijan Gyawali, Saroj Mishra, Suman Niroula, Dilip Thakur, and Umesh Yadav. Systematization of knowledge: Security and safety in the model context protocol ecosystem. arXiv preprint arXiv:2512.08290, 2025. [60]OpenAI.Simpleqa: Measuring short-form factual accuracy in large language models.https://w. datalearner.com/benchmarks/simpleqa, 2024. Accessed: 2025-02-06. [61] Yejin Bang, Ziwei Ji, Alan Schelten, Anthony Hartshorn, Tara Fowler, Cheng Zhang, Nicola Cancedda, and Pascale Fung. Hallulens: Llm hallucination benchmark. arXiv preprint arXiv:2504.17550, 2025. [62]Jingxiong Xu, Lisheng Huang, Fengjun Zhang, Zuoyuan Niu, Kai Shi, and Qinghua Li. The current state of research on reputation evaluation of network nodes. Electronics, 14(19):3900, 2025. [63]Guangyu Wang, Jianhong Liu, Meilin Zhou, Xiaoming Chen, Lihua Zhang, and Zhihao Sun. Toolbench 2.0: Evaluating long-horizon and multi-step tool use in llms. [64] Jingwei Yi, Yueqi Xie, Bin Zhu, Emre Kiciman, Guangzhong Sun, Xing Xie, and Fangzhao Wu. Benchmarking and defending against indirect prompt injection attacks on large language models. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1, pages 1809–1820, 2025. [65]Amit Kumar Singh. Data hiding: current trends, innovation and potential challenges. ACM Transactions on Multimedia Computing, Communications, and Applications (TOMM), 16(3s):1–16, 2020. 20 SoK: Trust-Authorization Mismatch in LLM Agent Interactions [66]Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM workshop on artificial intelligence and security, pages 79–90, 2023. [67] 36Kr European Central Station. Doubao mobile encounters obstacles in its initial battle, 2025. [68]Zehang Deng, Yongjian Guo, Changzhou Han, Wanlun Ma, Junwu Xiong, Sheng Wen, and Yang Xiang. Ai agents under threat: A survey of key security challenges and future pathways. ACM Computing Surveys, 57(7):1–36, 2025. [69]Abul Ehtesham, Aditi Singh, Gaurav Kumar Gupta, and Saket Kumar. A survey of agent interoperability protocols: Model context protocol (mcp), agent communication protocol (acp), agent-to-agent protocol (a2a), and agent network protocol (anp). arXiv preprint arXiv:2505.02279, 2025. [70]Xinyi Li, Sai Wang, Siqi Zeng, Yu Wu, and Yi Yang. A survey on llm-based multi-agent systems: workflow, infrastructure, and challenges. Vicinagearth, 1(1):9, 2024. [71]Zhen Xiang, Linzhi Zheng, Yanjie Li, Junyuan Hong, Qinbin Li, Han Xie, Jiawei Zhang, Zidi Xiong, Chulin Xie, Carl Yang, et al. Guardagent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning. arXiv preprint arXiv:2406.09187, 2024. [72]Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries, 2024. URL https://arxiv. org/abs/2310.08419, 1(2):3, 2024. [73]Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023. [74]Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451, 2023. [75]Zhiqiang Wang, Yichao Gao, Yanting Wang, Suyuan Liu, Haifeng Sun, Haoran Cheng, Guanquan Shi, Haohua Du, and Xiangyang Li. MCPTox: A benchmark for tool poisoning on real-world MCP servers. In The Fortieth AAAI Conference on Artificial Intelligence, 2025. [76] Liang-bo Ning, Shijie Wang, Wenqi Fan, Qing Li, Xin Xu, Hao Chen, and Feiran Huang. Cheatagent: Attacking llm-empowered recommender systems via llm agent. In Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, pages 2284–2295, 2024. [77]Yu Tian, Xiao Yang, Jingyuan Zhang, Yinpeng Dong, and Hang Su. Evil geniuses: Delving into the safety of llm-based agents. arXiv preprint arXiv:2311.11855, 2023. [78]Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases. Advances in Neural Information Processing Systems, 37:130185–130213, 2024. [79]Xiaohan Fu, Shuheng Li, Zihan Wang, Yihao Liu, Rajesh K Gupta, Taylor Berg-Kirkpatrick, and Earlence Fernandes. Imprompter: Tricking llm agents into improper tool use. arXiv preprint arXiv:2410.14923, 2024. [80]Miao Yu, Junfeng Fang, Yingjie Zhou, Xing Fan, Kun Wang, Shirui Pan, and Qingsong Wen. Llm-virus: Evolutionary jailbreak attack on large language models. arXiv preprint arXiv:2501.00055, 2024. [81]Tianyu Cui, Yanling Wang, Chuanpu Fu, Yong Xiao, Sijia Li, Xinhao Deng, Yunpeng Liu, Qinglin Zhang, Ziyi Qiu, Peiyang Li, et al. Risk taxonomy, mitigation, and assessment benchmarks of large language model systems. arXiv preprint arXiv:2401.05778, 2024. 21 SoK: Trust-Authorization Mismatch in LLM Agent Interactions A Appendix A.1 LLM usage considerations In this work, LLMs were used solely to assist with the refinement of the manuscript, including grammatical polishing, clarity improvements, and stylistic adjustments. The models were not involved in designing the methodology, generating experimental insights, or producing any novel technical contributions. All conceptual frameworks, analyses, and results presented in this paper were developed independently by the authors. The use of LLMs, therefore, serves only as an editorial aid and does not influence or alter the scientific validity or originality of the research. A.2 Taxonomy Appendix Scope. We focus on runtime interaction security of LLM-based agents: how agents perceive, decide, and act through protocols (e.g., MCP/A2A), tools/APIs, and local resources. Training-time data poisoning, model theft, and pretraining misalignment are out of scope unless they directly mediate runtime decisions. We expanded with class-specific queries (e.g., “prompt injection”, “tool poisoning”, “A2A spoofing”) and applied forward/backward snowballing from seed papers. When processing titles, papers clearly unrelated to compartmentalization are discarded. Abstracts are inspected if the title does not enable an unambiguous decision, and are sufficient to make an unambiguous decision in the most cases. We analyze the content of papers to determine if the study works in Stage 1-3 defined in Section 3.3. Inclusion/Exclusion criteria. We include artifacts that (i) concern LLM-based agents or agentic pipelines that call tools, access resources, or coordinate with agents; (i) discuss security failures/defenses with operational impact (C/I/A/accountability); and (i) provide sufficient detail to map to at least one Stage of our mismatch chain. We exclude artifacts that (i) only evaluate single-model harmlessness without external action, (i) concern training-time attacks unrelated to runtime decisions, or (i) lack verifiable technical substance (e.g., purely conceptual blog posts). A.3 Source Search Appendix The keywords considered for the automated search of papers on Google Scholar are: LLMs, agent, MAS, and protocol (including derived terms, as well as related attack keywords such as jailbreaking, poisoning, and prompt injection, and defense keywords such as detection and isolation). This yields279retrieved records, after which we performed automated de-duplication over titles/DOIs/URLs and normalized preprint/venue versions. Two reviewers independently screened titles/abstracts, followed by full-text screening, resulting in211de-duplicated unique items. Many false positives originate from projects that use these terms in unrelated contexts—such as general-purpose chatbot applications, multi-agent coordination frameworks without security relevance, or protocol utilities that do not involve adversarial interaction. We further inspect associated authors and organizations to identify additional works that follow similar security-oriented design principles but were missed due to inconsistent terminology. Finally, we incorporated 104papers from prior surveys and domain knowledge into the final included corpus to obtain a consolidated set of mainstream attack and defense techniques across LLMs, agents, MAS environments, and protocol-driven systems. Corpus construction. We performed a systematic literature review across systems-security venues (e.g., IEEE S&P, USENIX Security, CCS, NDSS), AI/ML venues (e.g., NeurIPS, ICML, ICLR, ACL), and major digital libraries (IEEE Xplore, ACM DL, USENIX, ACL Anthology), complemented with arXiv categories (cs.CR, cs.AI, cs.LG) and Google Scholar to capture grey literature. The search window spans Jan 1, 2023 to Nov 1, 2025 (UTC). Search strings. Grounded in our B–I–P lens, we used conjunctive queries targeting the intersection of agents, security, and tool-mediated actions, for example: (LLM OR “AI" OR agent) AND (security OR attack OR defense OR authorization) AND (tool OR API OR protocol OR interaction OR permission) Coding scheme and data extraction. For each artifact we extract: venue/year; component under study (victim component: user query, system prompt, tool return, agent return, local resource, protocol metadata); coverage of mismatch Stages (Stage 1 to 3); evaluation setting (simulated, real-system, incident); evidence level (concept/demo/em- pirical/incident); reproducibility assets (code/data/config); and attack/defense role. We will release a machine-readable table and scripts to reproduce the corpus and figures. PRISMA-style flow and availability. A PRISMA-style diagram summarizes279→ 211→ 102with reasons for exclusion (non-agentic, training-only, insufficient technical detail, duplicates). 22 SoK: Trust-Authorization Mismatch in LLM Agent Interactions Threats to validity (brief). (i) Venue bias: security incidents often appear first in grey literature; we mitigate via GL tagging and sensitivity analyses. (i) Temporal drift: the ecosystem evolves quickly; we record retrieval timestamps and archive URLs. (i) Selection bias: to reduce omission, we perform snowballing and query expansion; the artifact documents all queries. 23

Instant research discovery