MetaPermit is a new access control framework for AI agents that separates semantic inference from security enforcement. Instead of relying solely on static policies or LLM judges, it defines a small set of meta-attributes (e.g., intent_tool_alignment) that capture the relationship between user intent and tool calls. At runtime, an LLM infers these attributes, and a fixed policy applies deterministic rules to allow or deny each tool invocation, making decisions auditable.
Evaluated on AgentDojo and AgentDyn benchmarks with seven task suites and five attack methods, MetaPermit produced 31% more consistent authorization decisions than LLM-driven approaches. It also outperformed state-of-the-art defenses CaMeL and IPIGuard, improving task completion by up to 109% and reducing attack success rate to zero.
This work addresses a critical gap in agent security: scaling permission rules to open-ended tasks while maintaining consistency and auditability. The hybrid design reduces both false positives (tasks denied incorrectly) and false negatives (attacks allowed).