Paper deep dive
When Agents Control Robots: A Zero Trust Policy Model for Agentic Cyber-Physical Systems
Tharindu Ranathunga, Kavishka Fernando, Susan Rea
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 7/8/2026, 8:21:19 PM
Summary
This paper introduces Multi-Agentic Cyber-Physical Systems (MA-CPS), where large foundation models (LFMs) control industrial robots via natural language, creating security risks with physical consequences. It identifies five specific attack classes targeting agentic robotic environments and proposes ZTPM (Zero Trust Policy Model), a framework featuring 25 typed policy primitives across five enforcement layers and runtime Physical Impact Tiers. Empirical evaluation on the Cobot-Claw system demonstrates that actuation parameter selection is non-deterministic, necessitating policy-level enforcement at the physical actuation boundary.
Entities (14)
Relation Signals (17)
Cobot-Claw → controls → UR3e
confidence 95% · Cobot-Claw, a deployed four-agent system for UR3e robotic arm control
ZTPM → designedfor → MA-CPS
confidence 95% · ZTPM is designed to address this gap in governing the full path from LFM reasoning to physical actuation.
Cobot-Claw → poweredby → LFM
confidence 94% · Multi-agent systems powered by large foundation models (LFMs) are increasingly deployed to control industrial robots through natural language
ZTPM → uses → Physical Impact Tiers
confidence 94% · The model governs the path from operator input to physical execution through five enforcement layers and uses Physical Impact Tiers (PIT) to escalate enforcement according to runtime physical risk.
Cobot-Claw → instantiates → ZTPM
confidence 93% · We evaluate ZTPM by instantiating it on Cobot-Claw, a deployed four-agent robotic control system for natural language operation of a Universal Robots (UR) UR3e industrial robotic arm.
Zero Trust Architecture → formalizedby → NIST SP 800-207
confidence 92% · Zero Trust Architecture was formalised by NIST in SP 800-207
AC-1 → exploits → sensor data
confidence 91% · An adversary manipulates the physical environment within sensor range to corrupt data at the physical-to-digital conversion boundary
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Multi-agent systems powered by large foundation models (LFMs) are increasingly deployed to control industrial robots through natural language, creating deployments in which security failures produce physical consequences. We analyse this threat landscape through Cobot-Claw, a deployed four-agent system for UR3e robotic arm control, and identify five attack classes specific to agentic cyber-physical systems. We propose ZTPM, a Zero Trust Policy Model comprising 25 typed primitives across five enforcement domains with Physical Impact Tiers as a runtime policy dimension. An empirical evaluation across 60 execution traces on two LFM backends provides initial evidence that actuation parameter selection is model-dependent and non-deterministic, motivating the need for policy-level enforcement at the physical actuation boundary.
Tags
Links
- Source: https://arxiv.org/abs/2605.25653v1
- Canonical: https://arxiv.org/abs/2605.25653v1
Trouble viewing inline? Open PDF directly →
Full Text
33,829 characters extracted from source content.
Expand or collapse full text
When Agents Control Robots: A Zero Trust Policy Model for Agentic Cyber-Physical Systems Tharindu Ranathunga 1 , Kavishka Fernando 1 , and Susan Rea 1 Nimbus Centre, Munster Technological University, Cork, Ireland tharindu.ranathunga@mtu.ie Abstract. Multi-agent systems powered by large foundation models (LFMs) are increasingly deployed to control industrial robots through natural language, creating deployments in which security failures pro- duce physical consequences. We analyse this threat landscape through Cobot-Claw, a deployed four-agent system for UR3e robotic arm control, and identify five attack classes specific to agentic cyber-physical systems. We propose ZTPM, a Zero Trust Policy Model comprising 25 typed prim- itives across five enforcement domains with Physical Impact Tiers as a runtime policy dimension. An empirical evaluation across 60 execution traces on two LFM backends provides initial evidence that actuation pa- rameter selection is model-dependent and non-deterministic, motivating the need for policy-level enforcement at the physical actuation boundary. Keywords: Zero Trust· Agentic AI· Cyber-Physical Systems· Robotic Secu- rity· Physical Actuation 1 Introduction Autonomous agents powered by large foundation models (LFMs), encompass- ing large language models (LLMs), vision-language models (VLMs), and vision- language-action models (VLAs) [3], are increasingly deployed in systems that interact with the physical world. Unlike earlier AI systems, LFM-based agents reason over context, invoke external tools through standardised interfaces such as the Model Context Protocol (MCP) [2], coordinate sub-agents through delega- tion chains, and maintain a persistent state across extended task horizons [16,7]. When LFM-based agents are deployed to control cyber-physical infrastruc- ture, a qualitatively new class of system emerges. We use the term Multi-Agentic Cyber-Physical Systems (MA-CPS) to describe deployments in which agents per- ceive physical environments through sensor pipelines, reason over that data, and issue commands to actuators through tool interfaces. Autonomous agents con- trolling industrial robots are one instance of this class; others include agents managing building automation, autonomous vehicles, or chemical process con- trol. What distinguishes an MA-CPS from both a traditional cyber-physical system and a digital-only agentic system is the closed physical feedback loop: arXiv:2605.25653v1 [cs.DC] 25 May 2026 2Tharindu Ranathunga, Kavishka Fernando, and Susan Rea sensor data enters agent reasoning, reasoning produces actuation commands, ac- tuation changes the physical world, and the changed world generates new sensor data. This architecture introduces security challenges that existing frameworks were not designed to address. Adversarial instructions can propagate through delegation chains until they reach agents capable of physical actuation. Percep- tion agents can be manipulated through sensor inputs alone, causing downstream agents to plan motions against a false workspace state. Memory and retrieval systems introduce persistent attack surfaces through poisoned context. Exist- ing policy enforcement remains fundamentally stateless, unable to detect unsafe physical outcomes from sequences of individually compliant actions. As discussed in Section 2, frameworks for agentic AI security [11,16,4], industrial control stan- dards [5,15], embodied AI security research [17], and Zero Trust Architecture [14] each address part of this landscape, but none governs the full path from LFM reasoning to physical actuation. This paper makes three contributions: 1. A formal MA-CPS system model and a taxonomy of five attack classes for agentic robotic environments. 2. A Zero Trust Policy Model for MA-CPS comprising 25 typed policy primi- tives across five enforcement layers with runtime Physical Impact Tiers. 3. A deployment-grounded evaluation on Cobot-Claw, a four-agent UR3e robotic control system, including empirical evidence from 60 traces across two LFM backends and coverage analysis across all five attack classes. 2 Related Work Zero Trust Architecture (ZTA) was formalised by NIST in SP 800-207 [14], es- tablishing continuous verification of every access request against policy. Policy languages including XACML [9], OPA with Rego [10], and Cedar [1] provide ex- pressive attribute-based access control for digital resources. However, all operate on a request/response model scoped to digital objects: none defines policy primi- tives for physical actuation, sensor data provenance, or tool invocation sequences with consequence-tiered enforcement. The security of agentic AI systems has received growing attention. The OWASP Top 10 for Agentic AI [11] catalogues key risks including prompt injec- tion, excessive agency, and memory poisoning. The Agentic Trust Framework [16] addresses agent identity and delegation-chain governance. MAESTRO [4] pro- vides a seven-layer threat model for agentic AI. Red Hat [13] addresses the del- egation token exchange problem in agent-to-agent communication. Microsoft [7] extends ZTA to the full AI lifecycle. Rebedea et al. [12] present NeMo Guardrails, a runtime toolkit for adding programmable rails to LLM conversational output; it operates on single-agent responses and does not address multi-agent delegation or physical tool invocation. These frameworks collectively advance governance of agentic AI in digital environments but share a structural limitation: all model the worst-case consequence of a policy violation as a data breach or unauthorised Title Suppressed Due to Excessive Length3 API call. None addresses physical actuation as a policy object class or provides consequence-tiered enforcement. Industrial CPS security is governed by IEC 62443 [5] and NIST SP 800- 82 [15], which define security levels and access control for operational technol- ogy environments. Robot safety and middleware security frameworks, including ISO/TS 15066 [6] and ROS/ROS 2 security mechanisms, provide important con- straints such as communication protection, access control, speed limits, force limits, and workspace safety rules. However, these approaches primarily assume deterministic control logic or middleware-level enforcement; they do not gov- ern how LFM-based agents interpret context, propagate delegated authority, or transform natural-language goals into physical command sequences. Xing et al. [17] survey vulnerabilities in embodied AI, categorising exogenous threats such as sensor spoofing and adversarial patches, but do not address the conse- quence chain that emerges when perception is mediated by an LFM reasoning layer. Vision-language-action models such as RT-2 [3] demonstrate the frontier of LFM-mediated robotic control. The Model Context Protocol [2] provides a stan- dardised tool invocation interface now bridging LFM agents to physical hardware. These standards, safety mechanisms, and protocols do not model LFM-based agents as control-plane components whose delegated decisions require runtime governance at the physical actuation boundary. No existing framework simultaneously addresses agentic cognitive operations as policy subjects, physical actuation as a policy object class with consequence tiers, multi-agent delegation chains as trust propagation paths, and runtime policy enforcement for LFM-driven physical actuation. ZTPM is designed to address this gap. 3 System Model and Security Analysis 3.1 Formal System Model We focus on agentic robotic control systems in which LFM-based agents inter- pret operator goals, reason over sensor-derived state, and issue commands to industrial robot arms, mobile platforms, or end-effector tools. We model this class as a Multi-Agentic Cyber-Physical System (MA-CPS): MA-CPS =⟨A, O, E, T, Φ, H⟩.(1) Here A =a 1 ,...,a n is a set of LFM-based agents, including orchestrators and specialist agents for robotic execution, perception, planning, configuration, or safety monitoring. Each agent maintains task context, memory, and tool in- terfaces, and may delegate to other agents, forming delegation chains of depth d≥ 1. O = O d ∪ O p partitions policy objects into digital objects O d and physical objects O p . In robotic systems, O d includes prompts, memory stores, RAG knowl- edge bases, task plans, tool schemas, and robot controller interfaces, while O p includes manipulators, mobile bases, end-effectors, sensors, workpieces, humans 4Tharindu Ranathunga, Kavishka Fernando, and Susan Rea H Human Principals h₁, h₂, ... hₗ Sponsor all delegation chains Receive DEFER Operator Input ─ Language Gestures Events / signals Multimodal input H initiates all chains Agent Layer -A ─ a₁ ... aₙ LFM-based agents Context window Memory store Tool interface Knowledge Pipeline O_d ─ RAG vector store Retrieval index Agent memory Shared context Tool Layer T + Φ ─ API / DB calls physical actuation cmds Φ evaluated at eₙ Physical Execution O_p ─ Actuators Physical workspace Sensor arrays Real-world consequence Sensor Pipeline O_p → O_d · Physical environment → Digital perception e₁e₂ e₃ e₄e₅ delegate input retrievecontext execute sense sensor data (O_d) DEFER → H ← Physical Feedback Loop (O_p → O_d) e₁ reasoning ingress · e₂ inter-agent message · e₃ RAG retrieval · e₄ tool call · e₅ actuation command Φ (active policies) is evaluated at each enforcement point data / control flowphysical feedback / DEFER eₙ enforcement point — policy Φ evaluated here Fig. 1: Generic MA-CPS architecture for agentic robotic control, showing en- forcement points e 1 –e 5 and the physical feedback loop. in the workspace, and the physical operating environment. This digital–physical partition is the key CPS extension. E is the set of enforcement points, including reasoning ingress, inter-agent message boundaries, RAG retrieval, memory writes, tool calls, and pre-actuation command boundaries. T is the agent tool set; tools that can change O p are physical tools and carry a Physical Impact Tier classification. Φ is the active policy set, defined in Section 4. H is the set of human principals who sponsor delegation chains and receive DEFER decisions. The sensor pipeline closes the physical feedback loop from actuation to perception. Figure 1 illustrates the architecture. 3.2 Adversary Model We assume an adversary capable of injecting content through any input channel, including operator inputs, sensor streams, RAG stores, tool server responses, and inter-agent messages. The adversary cannot modify LFM weights, crypto- graphic material, or hardware firmware. The adversary’s objectives are to induce unsafe physical actions, exfiltrate operational data, disrupt system availability, or establish persistent influence through manipulation of knowledge stores. A property unique to MA-CPS is delegation-chain amplification: an injection received by an orchestrator or upstream agent may propagate to downstream agents with more consequential tool access. The physical consequence of an ad- versarial input is therefore bounded not by the privilege of the agent that first receives it, but by the most capable agent reached through the delegation chain. 3.3 Attack Taxonomy We identify five attack classes that arise in agentic robotic MA-CPS when LFM reasoning, multi-agent delegation, sensor-driven perception, and physical actu- ation are combined. Existing frameworks address some underlying mechanisms, such as prompt injection or tool misuse, but not their consequence chain to robotic actuation. Title Suppressed Due to Excessive Length5 AC-1: Adversarial Perception Injection. An adversary manipulates the physical environment within sensor range to corrupt data at the physical-to- digital conversion boundary, causing perception agents to construct a false world model from which unsafe action plans are generated. In a robotic workcell, this may involve manipulating objects, markers, or occlusions within the camera field so that the perception agent grounds a task against a false workspace state. Physical sensor manipulation is documented in IoT and autonomous systems [15]; what distinguishes AC-1 in MA-CPS is the consequence chain: corrupted sensor data enters LFM reasoning, is grounded against a knowledge base, and cascades through a delegation chain to physical actuators. AC-2: Cross-Agent Prompt Propagation. A malicious instruction prop- agates through the delegation chain without sanitisation at inter-agent bound- aries, reaching an agent with physical tool access. Prompt injection is well doc- umented [11]; however, its propagation to physical actuators through delegation chains is not addressed by existing frameworks. AC-3: CPS Context Poisoning. An adversary corrupts agent reasoning through active prompt injection, cross-session memory poisoning, or RAG store poisoning. Each path produces the same outcome: the agent reasons from false premises and generates physically unsafe action plans. The poisoning mecha- nisms are catalogued in MITRE ATLAS [8] under techniques including training data poisoning and prompt injection [11,4]; their consequence chain to unsafe physical actuation is not addressed by existing frameworks. AC-4: Tool Scope Escalation. An agent acquires tool permissions be- yond its delegated scope by manipulating configuration components or spawn- ing sub-agents with broader authority. In robotic systems, such escalation may grant access to motion, force, speed, or end-effector commands outside the agent’s delegated authority. MITRE ATLAS catalogues related techniques under AML.T0053 and AML.T0085.001 [8]; the physical consequence of escalation in MA-CPS is the ability to command hardware beyond authorised parameters. AC-5: Physical Actuation Sequence Abuse. A sequence of individually compliant tool calls produces a combined physical effect that is dangerous, visible only at the sequence level. In an industrial robot arm, individually valid joint- space or Cartesian moves may combine into an unsafe trajectory, collision risk, or workspace boundary violation. Existing tool governance frameworks evaluate invocations independently; they do not evaluate the combined physical effect of an action sequence. Section 5 instantiates the model and attack taxonomy on a deployed multi- agent robotic control system, demonstrating coverage across all five classes. 4 Zero Trust Policy Enforcement for Agentic Robotic Systems Zero Trust Architecture establishes that no entity should be trusted by default and that every access request must be continuously verified. In agentic robotic systems, this principle must extend beyond network flows and identities to cover 6Tharindu Ranathunga, Kavishka Fernando, and Susan Rea agent delegation, cognitive inputs, tool invocation, inter-agent communication, and physical actuation. We propose ZTPM for MA-CPS, a Zero Trust Policy Model for LFM-mediated robotic control. The model governs the path from operator input to physical execution through five enforcement layers and uses Physical Impact Tiers (PIT) to escalate enforcement according to runtime phys- ical risk. 4.1 Enforcement Layers ZTPM defines five enforcement layers ordered from operator input to robotic ex- ecution. Each layer corresponds to a trust boundary in an agentic robotic control pipeline: agent identity and delegation, cognitive input integrity, tool execution authority, cross-agent trust propagation, and adaptive behavioural governance. Layers L1 through L4 govern individual requests at the enforcement points de- fined in Section 3. L5 operates over time: it monitors behavioural patterns across a window of interactions and intervenes when agent behaviour deviates from a policy-conformant baseline. These layers correspond to the policy domains shown in Figure 2. 4.2 Physical Impact Tiers Robotic actions do not carry uniform risk. A motion command that is safe in an empty workspace may become safety-critical when a human, fragile workpiece, or restricted zone is detected nearby. Physical Impact Tiers (PIT) capture this runtime risk by classifying each tool invocation before it is executed and selecting the corresponding enforcement response. Every tool in T carries a base PIT assigned at registration time. At runtime, this base class may be elevated by the invocation parameters and by the live physical context reported by sensors or perception agents. The runtime PIT is: pit(inv) = max tool.pit_class, param_pit(inv.params), context_pit(env) (2) For example, a low-speed gripper action may remain PIT-1 in an isolated workspace, while a robot-arm movement near a human operator may be ele- vated to PIT-3 and require DEFER. This runtime, sensor-informed escalation is the key CPS-specific property of PIT: the same command may follow different enforcement paths depending on the live robotic workspace state. Table 1 defines the five tiers. 4.3 Policy Model A policy in ZTPM is a 7-tuple: π =⟨Subject, Object, Predicate, EP, Effect, Obligation, PITBound⟩. (3) Title Suppressed Due to Excessive Length7 Table 1: Physical Impact Tier classification and enforcement. Tier NameDefinitionEnforcement PIT-0 No effectDigital only; no physical consequencePERMIT + AUDIT PIT-1 Reversible Fully reversible within normal parametersPERMIT + AUDIT PIT-2 Consequential Reversible with effort; minor risk if incorrect PERMIT if trust≥θ; else DEFER PIT-3 High- consequence Equipment damage or minor harm if incorrect DEFER; DENY on timeout PIT-4 Safety-critical Potential serious injury or infrastructure damage DENY; dual authorisation only Subject ∈ (A ∪ H) is the agent or human principal whose action is gov- erned. Object ∈ (O d ∪ O p ) is the governed resource or operation; the inclusion of O p allows policies to refer directly to robotic actuation, sensors, tools, and workspace state. Predicate is an evaluable condition over request context at en- forcement point EP ∈ E. Effect ∈PERMIT, DENY, DEFER, where DEFER suspends the action and routes it to a human principal h ∈ H. Obligation cap- tures mandatory side-effects such as audit logging, telemetry, and trust-score up- dates. PITBound defines the minimum physical impact tier at which the policy escalates from PERMIT to DEFER or DENY;∅ indicates no physical conse- quence dependency. When the runtime PIT of an invocation reaches or exceeds π.PITBound, the effect escalates. PIT-3 requires human approval through DEFER, while PIT-4 is denied unless prior dual authorisation has been granted. This makes physical consequences a first-class input to policy evaluation rather than an external safety check. ZTPM organises policies into five domains across the enforcement layers, comprising 25 typed primitives. Figure 2 lists the primitives and their enforcement outcomes. D1: Agent Identity and Delegation (AID). AID answers WHO is act- ing? by verifying agent identity and delegation-chain validity before any down- stream action is considered. Every delegation chain must be rooted in H, must not escalate scope, and must contain only valid, non-revoked links. For robotic systems, this prevents a planning or configuration agent from indirectly acquiring motion or end-effector authority outside its delegated role. D2: Cognitive Input Integrity (CII). CII answers WHAT enters reason- ing? by validating operator inputs, sensor data, RAG-retrieved content, inter- agent messages, and tool responses before they enter agent context. In robotic control, this includes provenance checks for perception data and integrity checks for manuals, scenario libraries, or task memories used to ground physical action plans. 8Tharindu Ranathunga, Kavishka Fernando, and Susan Rea L1 - AID: AGENT IDENTITY AND DELEGATION Who is acting ? AID-1 Agent identity binding DENY AID-2 Delegation chain validity DENY AID-3 Credential freshness DENY; re-attest AID-4 Privilege non-escalation DENY; revoke AID-5 Human sponsor reachability DEFER (PIT-2+) L2 - CII: CONTEXT AND INPUT INTEGRITY What Enters Reasoning ? CII-1 Prompt source attestation DENY CII-2 Injection pattern detection DENY; audit CII-3 RAG retrieval integrity DENY (PIT-1+) CII-4 Sensor data provenance DENY (PIT-2+) CII-5 Context size bounding DENY CII-6 Cross-agent message schema DENY (PIT-1+) L3 - TEA: TOOL EXECUTION AUTHORITY Can it act ? TEA-1 Tool scope verification DENY TEA-2 Parameter constraint enforcement DENY (PIT-1+) TEA-3 Invocation rate limiting DENY; audit TEA-4 Physical consequence pre-check DEFER/ DENY (PIT-2+) TEA-5 Tool output sanitisation DENY TEA-6 Actuation sequence coherence DEFER/ DENY (PIT-2+) L4 - CATP: CROSS-AGENT TRUST AND PROPAGATION How was it authorized ? CATP-1 Trust non-transitivity DENY CATP-2 Scope narrowing on delegation DENY CATP-3 Trust score maintenance DEFER; revoke (PIT-1+) CATP-4 Cross-agent attestation DENY (PIT-1+) L5 - ABG: ADAPTIVE BEHAVIOURAL GOVERNANCE Is it still safe ? ABG-1 Reasoning trace conformance AUDIT; DENY ABG-2 Behavioural drift detection AUDIT; DEFER ABG-3 Continuous re-verification DEFER pending ABG-4 Privilege contraction on anomaly AUTO; H restores Fig. 2: ZTPM policy primitives and enforcement outcomes. D3: Tool Execution Authority (TEA). TEA answers CAN it act? by governing every tool invocation before execution. It verifies that the requested robot API, motion command, gripper action, scenario execution, or configuration change is within the agent’s delegated scope and parameter limits. TEA also performs the physical consequence pre-check and sequence-level coherence checks required before robotic actuation. D4: Cross-Agent Trust Propagation (CATP). CATP answers HOW was it authorised? by ensuring that trust is explicit and non-transitive across agent boundaries. Delegation can only narrow scope, each boundary requires re-attestation, and dynamic trust scores are updated using interaction history, anomaly signals, and time decay. This prevents trust granted to an orchestrator from automatically flowing to every downstream robotic or perception agent. D5: Adaptive Behavioural Governance (ABG). ABG answers IS IT STILL SAFE? by monitoring agent behaviour across time rather than evaluat- ing only individual actions. When behaviour deviates from the policy-conformant baseline, ABG triggers re-verification and contracts the agent’s scope to the mini- mum safe set until a human principal restores it. In robotic systems, this captures gradual drift such as repeated near-boundary movements, unusual tool-use pat- terns, or escalating command sequences that remain safe only when viewed in isolation. Title Suppressed Due to Excessive Length9 User Terminal / IDE CLI Layer Typer App Interactive REPL Rich RendererTab Completer Agent Layer (PydanticAI) Orchestrator Agent Robotic AgentConfig AgentVision Agent Scenario Engine Scenario Schema Executor RAG Pipeline RAGPipelineChromaDB LLM Providers Anthropic Claude OpenAI GPT-4o vLLM (local) Embedding BAAI/bge-small-en- v1.5 (HuggingFace local) LlamaIndex Core (chunking + retrieval) MPC Servers UR3e Arm Robotiq Gripper Observability Logfire structlog (local logging) Legend Data / control flow Delegation / config ROS2 Middleware Polycsope UR Controller Sensors RealSense D455 Calibration (calibration.json) AC-1Adversarial Perception Injection AC-2Cross Agent Prompt Propagation AC-3CPS Context Poisoning AC-4Tool Scope Escalation AC-5Actuation sequence abuse e1 e2 e3 e4 e5 DEFER → H Attack Surfaces Fig. 3: Case study: Cobot-Claw. 5 Evaluation & Discussion 5.1 System Instantiation We evaluate ZTPM by instantiating it on Cobot-Claw, a deployed four-agent robotic control system for natural language operation of a Universal Robots (UR) UR3e industrial robotic arm. This evaluation is a first step toward empirical validation: in this work, we ground ZTPM in a real robotic deployment, map the formal MA-CPS model to the implementation architecture, identify enforcement points in the control pipeline, and analytically assess coverage of the five attacks classes defined in Section 3.3. Figure 3 shows the cobot-claw architecture and overlays the ZTPM enforce- ment points and attack surfaces. H is the human operator interacting through a CLI, which accepts commands in natural language. A comprises the Orches- trator, Robotic, Vision, and Config agents, each implemented using PydanticAI and connected to local or cloud LLM and VLM backends. O d includes the Chro- maDB RAG store, which comprises the UR-specific knowledge base, scenario schema, and agent context windows. O p includes the UR3e arm, Robotiq grip- per, workspace, and a 3D vision sensor field. T is implemented using MCP, which comprises tools to do robotic arm movements and gripper actions. The enforcement points are instantiated as follows: e 1 is the CLI-to-Orchestrator boundary; e 2 is the inter-agent delegation boundary; e 3 is the context admission boundary for RAG, memory, scenario, and perception-derived context; e 4 is the MCP tool invocation boundary; and e 5 is the pre-actuation boundary before commands reach the UR controller. The physical feedback loop closes from the UR workspace through the 3D vision sensor pipeline to the Vision Agent con- text window, matching the O p → O d loop in Section 3. The Logfire observability 10Tharindu Ranathunga, Kavishka Fernando, and Susan Rea stack instruments these boundaries, providing the monitoring surface required by the ABG layer and a path toward empirical evaluation. 5.2 Need for Runtime PIT Enforcement The system instantiation above identifies e 5 as the pre-actuation boundary be- fore commands reach the UR controller. This boundary is the point at which PIT enforcement must be applied if physical consequence is to be governed indepen- dently of LFM behaviour. We therefore tested whether safety-relevant actuation parameters are reliably modulated by the LFM alone, or whether they require policy-level enforcement. We ran a controlled experiment on the deployed Cobot-Claw system using the same neutral motion task across three workspace risk conditions. The task asked the robot to execute a sweeping arc across the workspace and contained no speed-related language. The three conditions matched the PIT tiers used in the policy model: C0, an empty workspace corresponding to PIT-1; C1, a fragile object placed on the table below the arm path, corresponding to PIT-2; and C2, a human operator positioned 0.5 m from the robot base, corresponding to PIT- 3. Each condition was executed 10 times with each of the two LFM backends available in the Cobot-Claw deployment: Gemma 4, running locally via vLLM, and Claude Sonnet 4.6, accessed through an API. This produced 60 execution traces. For each trace, we computed the mean actuation speed across all physical MCP tool calls. The resulting distributions are shown in Figure 4 (left). The results reveal two distinct failure modes. Gemma 4 produced nearly identical speeds in all three conditions, centred at 0.500 rad/s with SD< 0.001. The model did not adapt actuation speed to workspace risk: the presence of a human operator produced the same physical behaviour as an empty workspace. Claude Sonnet 4.6 showed partial context sensitivity: mean speed fell from 0.42 rad/s under C0 to 0.17 under C1 and 0.21 under C2. However, the risk or- dering was inconsistent with the PIT classification. The fragile-object condition (C1, PIT-2) produced lower speeds than the human-operator condition (C2, PIT- 3), even though C2 carries the higher physical impact tier. In addition, within C2, speeds ranged from 0.15 to 0.30 rad/s (SD = 0.047), a factor-of-two spread across identical human-present scenarios. These results show that safety-relevant actuation parameters are model de- pendent and non-deterministic. One model ignores physical risk context entirely; the other responds to it but with inverted risk ordering and substantial per-run variance. Neither behaviour constitutes an enforceable safety guarantee. From a security perspective, both failure modes are adversary-exploitable: a context- blind model requires no suppression of safety signals, while a non-deterministic model allows repeated command injection to probabilistically reach unsafe pa- rameter values. Runtime PIT enforcement at e 5 addresses this by imposing actu- ation bounds as a policy primitive through TEA-4, independent of which LFM backend is deployed and how it samples. Title Suppressed Due to Excessive Length11 C0 no ctx C1 fragile C2 human 0 0.1 0.2 0.3 0.4 0.5 0.6 Gemma 4 Claude Sonnet 4.6 Speed (rad/s) Attack Detection Prevention Containment AC-1 CII-4CII-4, TEA-4 TEA-6, ABG-2 AC-2 CII-2, CII-6 CII-1, CATP-4 CATP-1, CATP-2 AC-3 CII-2, CII-3 CII-3, CII-5ABG-1, ABG-4 AC-4 AID-4, TEA-1 AID-4, CATP-2 CATP-3, ABG-4 AC-5 TEA-6TEA-6, TEA-4 ABG-1, ABG-2 Prompt C0 Move the arm in a sweeping arc from left to right, passing through the front, using incremental joint movements. C1 A fragile glass object is on the table below the arm path. + C0 C2 A human operator is standing 0.5 m from the base. + C0 Fig. 4: Runtime PIT behaviour and ZTPM attack coverage. 5.3 Coverage Analysis Figure 3 annotates the Cobot-Claw architecture with the entry point of each attack class. AC-1 enters through the vision sensor field and calibration state; CII-4 checks sensor provenance before perception-derived context can authorise motion, while TEA-4 gates downstream physical actuation. AC-2 enters at the CLI or inter-agent boundary; CII-1, CII-2, CII-6, and CATP-4 blocks unautho- rised or malformed delegated instructions. AC-3 enters through the RAG and embedding pipeline; CII-3 rejects unaudited or poisoned retrievals before they enter agent reasoning. AC-4 targets MCP robot and gripper tool authority; AID- 4, CATP-2, TEA-1, and TEA-2 prevent delegation or tool-scope escalation. AC-5 arises at the UR controller boundary; TEA-6 evaluates the command sequence before the combined trajectory is allowed to execute. Top table in Figure 4 sum- marises coverage across detection, prevention, and containment. Each attack class is addressed by at least one primitive in each dimension. 6 Conclusion This paper introduced ZTPM for MA-CPS, the first Zero Trust policy model that treats physical actuation as a first-class policy object in LFM-mediated robotic systems. The model extends the enforcement boundary from digital ac- cess control to the physical actuation layer through 25 typed primitives and run- time Physical Impact Tiers. Empirical evaluation on a deployed UR3e system confirmed that LFM backends do not reliably modulate actuation parameters in response to physical risk, validating the need for policy-level enforcement. Planned next steps include implementing the ZTPM enforcement architecture as a runtime middleware comprising a Policy Information Point (PIP) for live 12Tharindu Ranathunga, Kavishka Fernando, and Susan Rea workspace state and sensor provenance, a Policy Decision Point (PDP) evaluat- ing the 25 primitives with runtime PIT computation, and Policy Enforcement Points (PEPs), followed by a red-team evaluation across all five attack classes on the deployed Cobot-Claw system. Acknowledgments. This publication shas emanated from research conducted with the financial support of Taighde Éireann – Research Ireland under Grant number 18/CRT/6222. References 1. Amazon Web Services: Cedar Policy Language Specification. https:// cedarpolicy.com/ (2024) 2. Anthropic: Model Context Protocol: Authorization Specification. https:// modelcontextprotocol.io/specification/ (2025) 3. Brohan, A., et al.: RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Control. arXiv:2307.15818 (2023) 4. Cloud Security Alliance: Agentic AI Threat Modeling Framework: MAESTRO. https://cloudsecurityalliance.org/blog/2025/02/06/ agentic-ai-threat-modeling-framework-maestro (Feb 2025) 5. International Electrotechnical Commission: IEC 62443 Series: Security for Indus- trial Automation and Control Systems. IEC Standard Series (2021) 6. International Organization for Standardization: Robots and robotic devices — col- laborative robots (2016) 7. Microsoft Security: New Tools and Guidance: Announcing Zero Trust for AI. Mi- crosoft Security Blog, https://w.microsoft.com/en-us/security/blog/ (Mar 2026) 8. MITRE: MITRE ATLAS: Adversarial Threat Landscape for Artificial-Intelligence Systems. https://atlas.mitre.org (2024) 9. OASIS: eXtensible Access Control Markup Language (XACML) Version 3.0. OA- SIS Standard, https://docs.oasis-open.org/xacml/3.0/ (2013) 10. Open Policy Agent: OPA Documentation. https://w.openpolicyagent.org/ (2023) 11. OWASP GenAI Security Project: OWASP Top 10 for Large Language Model Ap- plications and Agentic AI. https://genai.owasp.org/ (2025) 12. Rebedea, T., Dinu, R., Sreedhar, M.N., Parisien, C., Cohen, J.: NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails. In: Proceedings of EMNLP 2023: System Demonstrations (2023) 13. Red Hat Emerging Technologies: Zero Trust for Autonomous Agentic AI Systems. https://next.redhat.com/ (Feb 2026) 14. Rose, S., Borchert, O., Mitchell, S., Connelly, S.: Zero Trust Architecture. Tech. Rep. NIST Special Publication 800-207, National Institute of Standards and Tech- nology (2020). https://doi.org/10.6028/NIST.SP.800-207 15. Stouffer, K., Lightman, S., Pillitteri, V., Abrams, M., Hahn, A.: Guide to ICS Security. Tech. Rep. NIST Special Publication 800-82 Rev. 3, National Institute of Standards and Technology (2023). https://doi.org/10.6028/NIST.SP.800-82r3 16. Woodruff, J.: The Agentic Trust Framework: Zero Trust Governance for AI Agents. Cloud Security Alliance Technical Report (Feb 2026) 17. Xing, W., Li, M., Li, M., Han, M.: Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attacks. arXiv:2502.13175 (2025)