Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices

Abstract:AI agents increasingly execute users' natural-language (NL) tasks by calling Web services, yet today's Web authorizes these calls through OAuth, which grants permissions over operators (e.g., TRANSFER), not operations (operator plus operands, e.g., transfer $100 to Bob). This gap cannot be closed by refining scope granularity, because operands are combinatorial, quantitative, and often derived from runtime computations across servers. Operator-scoped authorization therefore inherently overprivileges agents. We propose Precise Task-Scoped Implicit Authorization (PAuth): submitting a concrete NL task implicitly authorizes exactly the operations its faithful execution requires, even when the agent is compromised (e.g., by malware or prompt injection). Each server independently derives an NL slice, a symbolic specification of the expected call inspired by program slicing, and server-produced values are wrapped in signed envelopes that bind concrete values to symbolic provenance. Together, they enforce that every operation, not just the operator, is consistent with the user's task, closing the gap that OAuth leaves open. We evaluate PAuth on AuthBench, a benchmark we build on top of AgentDojo and cross-validate on OpenClaw, spanning five service suites with 100 benign tasks and 634 adversarial calls. All 100 benign tasks are implicitly authorized and all 634 adversarial calls are blocked. Many tasks require multiple tool calls to complete. A unique value of PAuth is that it frees users from having to approve each call with concrete operand values, including intermediate results they never specified. This enhances both security and usability.

Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Programming Languages (cs.PL)

arXiv:2603.17170 [cs.CR]

(or arXiv:2603.17170v2 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2603.17170 Focus to learn more arXiv-issued DOI via DataCite

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.