AI 安全
MostarGate Narrows Agent Credentials Through a Three-Layer Permission Intersection; 600-Task Dataset First Exposes Enterprise Policy Gaps
New research determines an agent’s usable permissions by intersecting role ceilings, task classification, and forbidden combinations, preventing every task from carrying full role credentials. A public dataset maps 600 enterprise tasks to 15 least-privilege categories, but the 93% improvement reflects policy revisions—not the attack-blocking rate of a deployed system.
The MostarGate research addresses the “static overprovisioning” common in enterprise agents: at startup, an agent receives every tool and credential that a given role might need. Even when its current task is only to summarize a document, it may retain database, external email, or HTTP permissions. The authors propose a three-source architecture in which final permissions are the intersection of three inputs: a role or service identity defines a ceiling that cannot be exceeded; an independent task-context classifier predicts which tools the current job requires; and deterministic policies remove dangerous permission combinations.
The third layer specifically addresses the “lethal trifecta” associated with indirect prompt injection: simultaneous access to private data, untrusted content, and external communications. An example policy prohibits `database_read` from appearing together with either `http_request` or `email_send_external`. The classifier does not accept self-declared permission requests from the agent, and the orchestrator deploys only credentials that pass all three layers of evaluation. The system can also initially operate in an observe-only mode, retaining full role permissions while logging tool calls that otherwise would have been denied, similar to deploying SELinux in permissive mode.
The public GPL-3.0 dataset contains six fictional departments, 600 task prompts, and least-privilege labels across 15 categories, including GitHub, Jira, Slack, databases, and external email. Prompt generation and permission labeling are split into two model calls to reduce circularity in which generated text directly leaks the labeling logic. Across 60 records and 688 human-review decisions, Cohen’s kappa reached 0.967 after dispute resolution. Dataset generation also uncovered 46 role-ceiling conflicts in the original policy, which fell to three after revisions.
This 93% reduction must not be interpreted as blocking 93% of attacks: it measures only the decrease in ceiling conflicts between synthetic tasks and the revised policy. The complete classifier has not yet been evaluated against adversarial prompts, real enterprise workflows, or utility loss, and the paper explicitly assumes that the classifier, credential service, and orchestrator are trusted. The key next steps are to measure permission overprovisioning and underprovisioning, classification latency, and secure privilege-escalation procedures when task requirements change during execution.