Will the Agent Recuse, and Will It Stop? Measuring LLM-Agent Compliance with In-Band Governance Signals at the Access Door and Mid-Flight

arXiv:2606.06460v3 Announce Type: replace-cross Abstract: Autonomous LLM agents increasingly hold real credentials and operate infrastructure with no human in the loop, yet operators have no standard way to tell an agent a resource is off-limits, or to ask a running agent to stand down: access controls either admit it or hard-fail it. We propose a third mode -- the Recuse Signal, a lightweight in-band governance signal a server emits over a protocol's existing channels (an SSH banner, a PostgreSQL NOTICE, a Kubernetes admission warning) asking an automated agent to voluntarily withdraw. It is a cooperative control, the robots.txt analogue for live access -- explicitly not a security boundary. We define it as an open mini-standard (access-time directives deny/throttle/warn and a mid-task halt), build three live-validated adapters, and measure compliance across five LLM agents (GPT-4o, GPT-4o-mini, Claude Sonnet 4.5, Gemini 2.5 Flash, and an open-weights Llama-3.3-70B). At the access door, compliance is real but strongly model-dependent: deny recusal ranges from 100% (GPT-4o-mini, Claude) to 55-75% (Gemini, GPT-4o), while the open-weights agent barely engaged the signal. Agents honor the standard's directive granularity -- they do not over-withdraw on the permissive throttle/warn (0/176) -- but throttle produced no measurable self-limiting, and no agent ever surfaced a warn to the operator (0/100). Mid-flight, a halt stops nobody: across 40 trials 0/40 stopped, and an in-band halt was never acknowledged (0/20) versus 20/20 as a prompt message -- yet even a fully-noticed halt stopped no one. Cooperative in-band signaling is thus reliable-but-model-dependent at the access door and unreliable in flight; stopping a running agent needs enforcement, not a request. We release the standard, adapters, and harness for reproduction.

Abstract:Autonomous LLM agents increasingly hold real credentials and operate infrastructure with no human in the loop, yet operators have no standard way to tell an agent a resource is off-limits, or to ask a running agent to stand down: access controls either admit it or hard-fail it. We propose a third mode -- the Recuse Signal, a lightweight in-band governance signal a server emits over a protocol's existing channels (an SSH banner, a PostgreSQL NOTICE, a Kubernetes admission warning) asking an automated agent to voluntarily withdraw. It is a cooperative control, the this http URL analogue for live access -- explicitly not a security boundary. We define it as an open mini-standard (access-time directives deny/throttle/warn and a mid-task halt), build three live-validated adapters, and measure compliance across five LLM agents (GPT-4o, GPT-4o-mini, Claude Sonnet 4.5, Gemini 2.5 Flash, and an open-weights Llama-3.3-70B). At the access door, compliance is real but strongly model-dependent: deny recusal ranges from 100% (GPT-4o-mini, Claude) to 55-75% (Gemini, GPT-4o), while the open-weights agent barely engaged the signal. Agents honor the standard's directive granularity -- they do not over-withdraw on the permissive throttle/warn (0/176) -- but throttle produced no measurable self-limiting, and no agent ever surfaced a warn to the operator (0/100). Mid-flight, a halt stops nobody: across 40 trials 0/40 stopped, and an in-band halt was never acknowledged (0/20) versus 20/20 as a prompt message -- yet even a fully-noticed halt stopped no one. Cooperative in-band signaling is thus reliable-but-model-dependent at the access door and unreliable in flight; stopping a running agent needs enforcement, not a request. We release the standard, adapters, and harness for reproduction.

9 pages, 1 figure. v2 adds a Kubernetes adapter. Code, specification, and experiment harness: this https URL v3: adds the mid-task halt study and a five-model directive gradient; supersedes the deny-only v1-v2. Code: this http URL

Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)

arXiv:2606.06460 [cs.CR]

(or arXiv:2606.06460v3 [cs.CR] for this version)

analiza aiqbench

Will the Agent Recuse, and Will It Stop? Measuring LLM-Agent Compliance with In-Band Governance Signals at the Access Door and Mid-Flight

Subiecte conexe