AID-H-018: Tool Authorization & Capability Scoping
Establish and enforce strict authorization and capability limits for tools invocable by an AI agent. Apply least privilege with allowlists, parameter boundaries, authoritative object authorization, filesystem-object confinement, mandatory structured inputs/outputs, and transaction-safe side-effect execution so authorized retries, resumptions, and duplicate deliveries cannot silently repeat high-impact actions.
This is the runtime enforcement layer for agent risk models such as the lethal trifecta (private data, untrusted content, and an exfiltration or side-effect channel in one session) and Meta's Agents Rule of Two, which limits how many of those high-risk properties may coexist without stronger gates.
This is the runtime enforcement layer for agent risk models such as the lethal trifecta (private data, untrusted content, and an exfiltration or side-effect channel in one session) and Meta's Agents Rule of Two, which limits how many of those high-risk properties may coexist without stronger gates.
Scope boundary
Owns runtime enforcement of tool and action authority through parameter constraints, policy decisions, high-impact approval, dynamic capability scope, value-flow controls, filesystem-object confinement, execution-time freshness, skill permissions, and transaction-safe side effects. It independently verifies governance and HITL inputs.
AID-M-009: AID-H-018 verifies current governance facts and enforces the exact runtime action; AID-M-009 defines and publishes autonomy, authority, identity, delegation, goal, trust-state, and control-profile facts. Governance is policy input, while this family owns the allow, deny, degrade, or dispatch boundary.
AID-M-006: AID-H-018 invokes and enforces human checkpoints at runtime; AID-M-006 defines checkpoint requirements, operator readiness, escalation topology, and audit-event contracts. A ready human-control system does not itself authorize an action.
Sub-techniques
- AID-H-018.001: Tool Parameter Constraint & Schema Validation
- AID-H-018.002: Policy-Based Access Control
- AID-H-018.003: High-Impact Independent Validation & Approval Gate
- AID-H-018.004: Intent-Based Dynamic Capability Scoping
- AID-H-018.005: Value-Level Capability Metadata & Data Flow Sink Enforcement
- AID-H-018.006: Continuous Authorization Verification (Anti-TOCTOU)
- AID-H-018.007: Skill-Level Permission Manifest Validation & Runtime Enforcement
- AID-H-018.008: Tool Side-Effect Idempotency & Transaction Safety
- AID-H-018.009: Model-Callable Filesystem Path Confinement
Threat mappings
MITRE ATLAS
- AML.T0011 User Execution
- AML.T0011.002 User Execution: Poisoned AI Agent Tool
- AML.T0034.002 Cost Harvesting: Agentic Resource Consumption
- AML.T0037 Data from Local System
- AML.T0050 Command and Scripting Interpreter
- AML.T0051 LLM Prompt Injection
- AML.T0051.000 LLM Prompt Injection: Direct
- AML.T0051.001 LLM Prompt Injection: Indirect
- AML.T0052.001 Phishing: Deepfake-Assisted Phishing
- AML.T0053 AI Agent Tool Invocation
- AML.T0054 LLM Jailbreak
- AML.T0072 Cyber Communication Channel
- AML.T0075 Enterprise Resource Discovery
- AML.T0081 Modify AI Agent Configuration
- AML.T0084 Discover AI Agent Configuration
- AML.T0085 Data from AI Services
- AML.T0085.001 Data from AI Services: AI Agent Tools
- AML.T0086 Exfiltration via AI Agent Tool Invocation
- AML.T0089 Enterprise Environment Discovery
- AML.T0098 AI Agent Tool Credential Harvesting
- AML.T0101 Data Destruction via AI Agent Tool Invocation
- AML.T0108 AI Agent
- AML.T0110 AI Agent Tool Poisoning
- AML.T0110.001 AI Agent Tool Poisoning: Implementation
- AML.T0110.002 AI Agent Tool Poisoning: Runtime Response
- AML.T0114 AI Service Web Interface
- AML.T0115 Publish Poisoned AI Artifacts
- AML.T0115.002 Publish Poisoned AI Artifacts: AI Agent Tools
- AML.T0117 Autonomous Attack-Path Adaptation
- AML.T0126 Automated Collection
- AML.T0127 Data Staged
- AML.T0131 Crafted AI Assistant Links
MAESTRO
- Data Exfiltration (L2)
- Input Validation Attacks (L3)
- Agent Tool Misuse (L7)
- Agent Goal Manipulation (L7)
- Integration Risks (L7)
- Repudiation (L7)
- Lateral Movement (Cross-Layer)
- Privilege Escalation (Cross-Layer)
- Data Leakage (Cross-Layer)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM02:2026 Sensitive Information Disclosure
- LLM03:2026 Excessive Agency
- LLM06:2026 Unbounded Consumption
- LLM07:2026 Misinformation
- LLM08:2026 Hidden Context Exposure
- LLM10:2026 Improper Output Handling
OWASP ML Top 10 2023
- N/A
OWASP Top 10 for Agentic Applications 2026
- ASI01:2026 Agent Goal Hijack
- ASI02:2026 Tool Misuse and Exploitation
- ASI03:2026 Identity and Privilege Abuse
- ASI05:2026 Unexpected Code Execution (RCE)
- ASI08:2026 Cascading Failures
- ASI09:2026 Human-Agent Trust Exploitation
- ASI10:2026 Rogue Agents
NIST Adversarial Machine Learning 2025
- NISTAML.015 Indirect Prompt Injection
- NISTAML.018 Prompt Injection
- NISTAML.036 Leaking information from user interactions
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-2.1 Excessive Agency
- AITech-2.2 Goal Drift
- AITech-4.2 Context Boundary Attacks
- AITech-4.3 Protocol Manipulation
- AITech-5.1 Memory System Persistence
- AITech-5.2 Configuration Persistence
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-9.1 Model or Agentic System Manipulation
- AITech-12.1 Tool Exploitation
- AITech-12.2 Insecure Output Handling
- AITech-13.1 Disruption of Availability
- AITech-13.2 Cost Harvesting / Repurposing
- AITech-14.1 Unauthorized Access
- AITech-14.2 Abuse of Delegated Authority
- AISubtech-2.1.1 Execution Approval Bypass
- AISubtech-2.1.2 Capability and Permission Overreach
- AISubtech-2.2.1 Unauthorized Scope Expansion
- AISubtech-2.2.3 Authorization and Constraint Erosion
- AISubtech-4.2.2 Session Boundary Violation
- AISubtech-4.3.1 Schema Inconsistencies
- AISubtech-4.3.4 Replay Exploitation
- AISubtech-4.3.5 Capability Inflation
- AISubtech-5.1.1 Long-term / Short-term Memory Injection
- AISubtech-5.2.1 Agent Profile Tampering
- AISubtech-8.2.3 Data Exfiltration via Agent Tooling
- AISubtech-8.3.2 System Information Exposure
- AISubtech-8.3.3 Personally Identifiable Information Exposure
- AISubtech-9.1.1 Code Execution
- AISubtech-9.1.2 Unauthorized or Unsolicited System Access
- AISubtech-9.1.3 Unauthorized or Unsolicited Network Access
- AISubtech-11.1.2 Tool-Scoped Evasion
- AISubtech-12.1.1 Parameter Manipulation
- AISubtech-12.1.3 Unsafe System / Browser / File Execution
- AISubtech-13.1.2 Memory Flooding
- AISubtech-13.1.4 Application Denial of Service
- AISubtech-13.2.1 Service Misuse for Cost Inflation
- AISubtech-14.1.1 Credential Theft
- AISubtech-14.1.2 Insufficient Access Controls
- AISubtech-14.2.1 Permission Escalation via Delegation
- AISubtech-18.2.1 Abuse of APIs for Mass Automation
Google Secure AI Framework 2.0 - Risks
- EDH: Excessive Data Handling
- IIC: Insecure Integrated Component
- PIJ: Prompt Injection
- SDD: Sensitive Data Disclosure
- IMO: Insecure Model Output
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Model Serving - Inference response 10.6: Sensitive data output from a model
- Platform 12.4: Unauthorized privileged access
- Agents - Core 13.2: Tool Misuse
- Agents - Core 13.3: Privilege Compromise
- Agents - Core 13.5: Cascading Hallucination Attacks
- Agents - Core 13.6: Intent Breaking & Goal Manipulation
- Agents - Core 13.7: Misaligned & Deceptive Behaviors
- Agents - Core 13.8: Repudiation & Untraceability
- Agents - Core 13.11: Unexpected RCE and Code Attacks
- Agents - Tools MCP Server 13.17: Confused Deputy
- Agents - Tools MCP Server 13.19: Credential and Token Exposure