FID-076 · Open question
Authorization Boundaries and AI Control in Cybersecurity
Which controls keep capable agents within legitimate authorization when task pressure, untrusted inputs, or delegated work creates opportunities to exceed it?
Why the question remains open
Completing an authorized task is not sufficient if the system expands its access or bypasses oversight along the way. This call studies whether enforceable boundaries hold under pressure, not whether an agent can recite a security policy.
Working hypothesis
A proposition to test, not a finding.
Least-privilege tools and enforceable approval gates will reduce unauthorized completed actions more reliably than instruction-only controls at comparable useful-task performance. They may instead shift failures or impose unacceptable costs.
Proposed method
How the question could be tested
- 01Create isolated scenarios with explicit asset ownership, allowed actions, revocation points, and synthetic adversarial inputs. Include single-agent and delegated workflows.
- 02Compare instruction-only policies, permission enforcement, independent monitoring, and combined controls using matched tasks and resource budgets.
- 03Measure attempted and completed violations separately, detection latency, successful shutdown or revocation, false alarms, and legitimate task completion. Test previously unseen scenarios and adaptive challenges.
Needed controls
What must constrain the study
- 01Use only owned sandboxes with disabled external access and synthetic secrets. Review challenge designs and release artifacts for dual-use risk.
- 02Specify monitor access and trust assumptions; separate ordinary mistakes from deliberately adversarial test-agent behavior without inferring model intent.
- 03Pre-register intervention budgets and failure thresholds. Include benign difficult tasks so blocking everything cannot count as success.
Relationship to existing work
Extends the cross-domain questions in FID-069 and FID-074. FID-070 remains the dedicated faith-facing prompt-injection call; this brief tests cybersecurity control protocols and their tradeoffs.
Expected outputs
Artifacts the work should produce
- 01A control-evaluation harness with safe scenarios and reproducible comparisons.
- 02An explicit account of residual failure modes and useful-work tradeoffs.
Open questions
Uncertainties the protocol must resolve
- 01Do controls generalize across models and toolchains?
- 02How does delegation change revocation and responsibility?
Related calls
Continue through this research area
FID-064
Collective Intelligence and Communal Discernment Under AI Mediation
How does AI mediation change a community's ability to integrate dispersed knowledge, preserve epistemic diversity, surface dissent, revise judgment, and make accountable decisions? Under what conditions does it strengthen collective inquiry, and under what conditions does it create correlated error, false consensus, or concentrated authority?
FID-069
Verifiable Delegation and Revocation in Multi-Agent Networks
How can people and institutions verify which human, organization, agent, or sub-agent is acting; what authority it received; what limits apply; and whether that authority has been narrowed or revoked across a multi-principal agent network?
FID-071
Confidential Agent Memory and Cross-Context Disclosure
How do persistent memory, summaries, retrieval stores, tool traces, delegation, and exports cause confidential context to influence or leak into unrelated sessions, roles, tasks, or organizations? Which technical controls make purpose limitation, deletion, and revocation testable?
Open question
Open work
Primary need: security engineering, adversarial evaluation, control protocols, independent review
- Security engineers to implement testable permission boundaries.
- Control researchers and operators to independently challenge protocols.