arXiv Science⌕ Search
Home/Archive/arXiv

arXiv · 2611.06764

Rethinking Access Control for AI Agents: Recent Advances and Open Challenges

Chijin Zhou·Quan Zhang
View original source ↗Read source document ↗Export metadata ↓

Abstract

Large language model agents access data, invoke tools, and act on users' behalf. Keeping these actions within authorized bounds is challenging because agents choose their own execution paths while permissions and operating conditions may change. This paper surveys recent advances in agent access control across four areas: policy specification and derivation, identity and delegation, action and resource enforcement, and information flow control. We compare their control objects, enforcement boundaries, and assumptions to examine what individual mechanisms achieve and how they can work together. Building on this analysis, we rethink four aspects of authorization: plan selection shapes permission requirements; contextual information can inform decisions without itself granting authority; restrictions must retain their meaning across system interfaces; and authorization must be reassessed as workflows evolve. These insights motivate open challenges and future directions, together with concrete research questions and evaluation criteria. In particular, evaluation should examine both observed agent behavior and the unauthorized effects that remain enabled. Our analysis connects existing mechanisms to the requirements for preserving authorization throughout an agent workflow.

Explore related subjects

cs.SE

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Chijin Zhou, Quan Zhang. 2026-11-04. Rethinking Access Control for AI Agents: Recent Advances and Open Challenges. https://arxiv.org/abs/2611.06764

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Characterizing Robustness in Semantic Code Clone Detection

Semantic code clone detection seeks to recognize shared functionality across different implementations, making robustness to behavior-preserving changes central to its effectiveness. Prior studies have exposed failures under such changes, motivating a systematic examination of how sensitivity varies with the rewrites used for evaluation. We present Systematic Code Transformation (SCT), a framework organizing 51 operators by code level, target, and edit category, and evaluate 14 token, tree, graph, and prompt-based detectors on BigCloneBench, Google Code Jam, and OJClone. By comparing transformation groups, repeated application, and alternative constructions, we connect overall performance changes with specific rewriting conditions. Of 25 token, tree, and graph detector and dataset combinations starting above 90% F1, 21 lose at least 10 percentage points under the composition of all operators. These losses vary with transformation type and application intensity, but are not determined by edit counts or code growth alone. Even at matched locations and edit counts, alternative constructions can expose different errors despite similar aggregate losses. Further analysis distinguishes reduced score separability from changed fixed-threshold decisions with retained ranking ability, revealing different scope for threshold recovery. Overall, these findings show why benchmark effectiveness needs to extend to stable discrimination across equivalent implementations and how systematic transformation testing can assess that capability.

cs.SE↗
arXiv2026

Vibe Coding in Software Development: A Multivocal Literature Review

Vibe coding is an AI-assisted software development approach in which developers express intent in natural language and large language models generate code. To our knowledge, no review has synthesized academic and practitioner sources under a common protocol. We conducted a multivocal literature review of publications from January 2022 to 9 September 2026, identified through searches in October 2025 and September 2026. After assessing source quality and credibility, we analyzed 266 sources (76 peer-reviewed, 190 grey) across eight research questions: 146 were direct, 93 adjacent, and 27 background. Presence and outcome findings receive reporting-support and evidence-strength labels, respectively. The second author conducted twelve checks; pre-reconciliation agreement was low in several, but substantial for the final directness rule and moderate for the outcome fields, which were checked in full. Sources describe a generation-evaluation-revision loop, with developer work shifting from writing code toward directing, supervising, and validating. Productivity is reported in 109 of the 159 sources contributing to the outcome question, of which 22 provide assertions only; these counts indicate reporting, not effect size. Most comparable sources report short-term productivity gains and long-term maintainability costs, but both receive Weak evidence-strength labels because some comparable sources report opposing directions. Short-term quality and defects are labeled Weak. Long-term productivity, long-term quality, and short-term reproducibility are labeled Moderate. Prototyping is reported more often than production use, and user-interface work more often than data and machine-learning work, but task-domain evidence is sparse. Future work should evaluate safeguards, session-level dynamics, long-term maintainability, and production use.

cs.SE↗
arXiv2026

How Should Agents See Code? Rethinking Code Representations for Agentic Software Engineering

LLM agents are increasingly used for repository-level software engineering tasks. However, most agents still access repositories through raw files, lexical search, and shell commands, treating code primarily as text. This paper investigates map-based code-representation workflows as a design variable in agentic software engineering, examining how different repository views change agents' retrieval behavior, task success, token use, and latency. In this paper, we study five code-representation workflows: abstract syntax trees, call graphs, module dependencies, documentation-enriched search, and a hybrid workflow that combines them. Each workflow exposes a repository map that the agent can query during a task. We evaluate Claude Code with Haiku 4.5 against a raw-tool baseline on four repository-level tasks: fault localization with LinuxFLBench, repository-level code generation and repair with SWE-bench Pro, test generation with SWT-bench, and security patching with SecBench. The results show that representation workflows are most useful as token-saving tools when localization is the bottleneck, while their success gains narrow when the decisive step is patch or test authoring. On LinuxFLBench, all five workflows improve recall@10 over the baseline (0.757-0.829 vs. 0.717) and reduce token usage by 25-39%. On SWE-bench Pro, resolution remains close to the baseline (44.3-50.6% vs. 49.0%) while token usage drops by 17-26%. On SecBench, Callgraph has the highest patch-resolution rate in this sample (34.3% vs. 28.9%) and uses fewer tokens, but all workflows increase latency. On SWT-bench, Hybrid and Docs have the highest reproducing-test rates in this sample (47.8% and 47.2% vs. 44.7%), but all workflows use more tokens and take longer. Overall, map-based workflows change both what the agent inspects and how much it spends, but their benefits are task-dependent rather than universal.

cs.SE↗