CAGE Adds Joint Authorization Certificates to Agent Tool Responses, Preventing Field Misbinding and Numeric Drift from Bypassing Gates Together

Tool-using agents typically parse MCP or API responses into typed records, after which an authorization gate determines whether subsequent actions may be executed. CAGE argues that current approaches generally validate only the immediate “response–action” pair. If a source label is misbound, data is stale, or a numeric value drifts within an allowed tolerance, the gate may still approve a transaction that actually violates policy.

The research separates tool responses into source and categorical fields, and continuous numeric fields. Its threat model permits one acceptable discrete binding error together with a bounded numeric perturbation. The key result is that the two marginal certificates cannot simply be composed: an action may separately pass checks that change “only the source” and “only the numeric value,” yet cross a different policy threshold when the source and value change together. For example, the same risk score may be subject to different approval criteria in a credit check and a sanctions screening.

CAGE therefore fully enumerates the discrete neighborhood first, then verifies continuous perturbations for every branch. When the authorization policy itself is executable, CAGE-Exact proves the policy directly. Otherwise, CAGE-Lip uses a 1-Lipschitz gate, while CAGE-RS constructs a certificate using randomized smoothing. However, the latter two can certify only the learned classifier, so its agreement with the actual policy must be measured separately. Cases outside the certified region are denied automatic execution and escalated for human review.

The authors tested the system on synthetic data, OPA/Rego policy-as-code, regulatory rules, and adapters for real transaction data. They claim it eliminates false allows within the perturbation budget while preserving some autonomous decision-making. The library provides tabular mapping commands, fast CPU tests, and test frameworks for Kubernetes, Kyverno, and MCP to facilitate result verification. Its guarantees, however, depend on whether the modeled error neighborhood covers real deployment conditions. It also does not address prompt injection or malicious text; it protects only validated, typed responses. Future evaluation should examine binding-error rates in production systems, the proportion of cases requiring human takeover, and the enumeration cost for large schemas.