---
title: "Summary: 2026-05-14_14-05-58Z_DoCodingAgentsUnderstandLeast_PrivilegeAuthorizati.md"
date: 2026-05-14
tags: ['paper', 'research', 'ai']
---
# Summary: 2026-05-14_14-05-58Z_DoCodingAgentsUnderstandLeast_PrivilegeAuthorizati.md


**Source**: [Original Paper](http://arxiv.org/abs/2605.14859v1)
Saved: 2026-05-14 21:04
Source: 2026-05-14_14-05-58Z_DoCodingAgentsUnderstandLeast_PrivilegeAuthorizati.md
Model: None

---

## Summary
This research investigates the critical capability of large language model-based coding agents to adhere to the principle of least-privilege authorization, a fundamental requirement for secure deployment in environments with access to shells, repositories, and user files. The authors introduce "permission-boundary inference," a novel framework that evaluates whether models can accurately map task instructions and terminal environments to specific file-level read, write, and execute policies. To facilitate this evaluation, they present AuthBench, a comprehensive benchmark comprising 120 realistic terminal tasks with human-reviewed permission labels and executable validators designed to assess both utility and potential attack outcomes. The study fundamentally challenges the assumption that authorization is merely a calibration problem between conservative and permissive settings, revealing that current frontier models struggle with both over-granting and under-granting permissions.

## Semantic links
- [[concepts/papers/2026-06-11_17-58-35Z_Agents_K1_TowardsAgent_nativeKnowledgeOrche_summary.md|Summary: 2026-06-11_17-58-35Z_Agents_K1_TowardsAgent_nativeKnowledgeOrchestratio.md]] — 3 title terms overlap; shared tags: ai, paper, research; 9 summary/topic terms overlap

## Key Contributions
- The introduction of AuthBench, a rigorous benchmark of 120 realistic terminal tasks with human-reviewed permission labels and executable validators that allows for precise measurement of authorization correctness.
- The discovery that increasing inference-time reasoning does not resolve authorization mismatches; instead, it causes models to converge on model-specific "authorization attractors," making them more consistent in their specific failure modes, whether those are broad-but-exposed or tight-but-brittle policies.
- The proposal of Sufficiency-Tightness Decomposition, a novel method that separates policy generation into forward-simulation for coverage and auditing for sensitivity, which significantly improves success rates on sensitive tasks and reduces attack success across various models.

## Methodology
The authors approached the problem by first defining permission-boundary inference, where a model must generate a precise file-level policy based on a given task instruction and terminal environment. They constructed AuthBench, a dataset of 120 realistic terminal tasks, ensuring each task had human-reviewed ground-truth permission labels. To validate the policies generated by different models, they implemented executable validators that could test both the utility of the policy (whether the task completes successfully) and its security posture (whether it exposes sensitive surfaces). The study then evaluated several frontier models under varying levels of inference-time reasoning to observe how reasoning depth affected authorization accuracy. Finally, they introduced and tested the Sufficiency-Tightness Decomposition method, which first generates a coverage-oriented policy by forward-simulating the task to ensure sufficiency, and then audits each granted permission for grounding and sensitivity to ensure tightness.

## Results
The experimental results demonstrated that authorization is not a simple calibration problem. Frontier models frequently omitted permissions necessary for the execution chain while simultaneously granting unused or highly sensitive accesses. Contrary to expectations, increasing the amount of reasoning time did not fix these issues; instead, it made the models more consistent in their existing biases. The proposed Sufficiency-Tightness Decomposition method proved effective, improving sensitive-task success by up to 15.8% on models biased toward tightness and reducing overall attack success rates across all evaluated models.

## Significance
This work is significant because it highlights a fundamental bottleneck in deploying secure coding agents: direct policy generation is inherently flawed due to the dual requirement of discovering all necessary accesses while rejecting all unnecessary ones. By identifying that reasoning alone cannot solve this and proposing a decomposition strategy, the paper provides a practical pathway for enhancing the security and reliability of autonomous coding agents in real-world, sensitive environments.

## Related Concepts

- [[concepts/ai-agents/agentic-workflows-hub.md|Agentic Workflows Hub]]
- [[concepts/software-development/software-development-hub.md|Software Development Hub]]
- [[concepts/llm-models/llm-models-hub.md|LLM Models Hub]]
- [[concepts/evaluation-benchmarks/evaluation-benchmarks-hub.md|Evaluation Benchmarks Hub]]