What they did

The authors developed SARA, a runtime framework that separates action induction—content suggesting what an agent should do—from authorization to execute that action. A context-isolated Action Probe identifies action-inducing semantics in tool observations and records their provenance across multiple steps.

Before executing a tool call, SARA checks whether it is supported by the user’s objective and evidence from authorized, successful prior executions. It also applies No-History-Promotion, preventing repeated appearance in the agent’s history from turning an untrusted instruction into trusted authority. The framework was evaluated on AgentDojo and AgentDyn and tested with additional agent backbones.

Key findings

• SARA limited attack success rate (ASR) to no more than 0.63% across four primary evaluation settings.
• The framework maintained competitive utility on benign tasks, according to the authors.
• Separating action provenance from execution authority reduced attack success consistently across additional agent backbones.
• Persistent provenance tracking prevented multi-step recurrence from effectively laundering untrusted action suggestions into authorized commands.

Why it matters

Tool-using agents routinely consume untrusted emails, webpages, documents, and API responses. SARA’s central contribution is an authorization boundary: model-generated tool calls must be justified independently of the content that induced them, offering a way to constrain side effects without preventing agents from using external information.

Caveats

The abstract does not report detailed utility scores, per-benchmark results, computational overhead, or comparisons with every relevant defense. The evidence is limited to AgentDojo, AgentDyn, and the tested backbones; whether the authorization rules remain robust in longer, less structured workflows or with incomplete user objectives remains open.