Permission tables can offer several minimal grants
Incomparable Minima in Agent Tool Authorization · arXiv:2610.31914
In plain words
When two permissions both let an agent finish a task, which one gives it less authority? This paper checks that question against permission tables published by Microsoft and Google.
The authors compare the operations each grant allows and list the grants that are sufficient but cannot be made smaller.
Some tasks have several such grants, with neither clearly smaller than the others. In Microsoft Graph tasks built from endpoint groups, this happened in about three in ten DelegatedWork and Application tasks. The rates describe those table-based tasks, not all tasks agents perform.
The research
When an agent can complete a task with either of two grants, which one should count as least authority? Benchmarks and permission solvers need that answer, but vendor tables may leave several sufficient grants that cannot be ordered by how many operations they authorize.
The authors compare grants by authorized operations and find that vendor tables can leave multiple minimal choices for a task.
The authors compare grants by the operations they authorize, then enumerate the minimal grants sufficient for tasks generated from vendor tables. A task has multiple minima when none authorizes a subset of another’s operations.
This occurs in 29.8% of Microsoft Graph DelegatedWork tasks and 30.7% of Application tasks generated from endpoint groups. The rates show that these tables do not always yield one least-authority choice for the specified tasks.
These rates describe tasks generated from published authorization tables, not workloads observed from deployed agents. The tables omit resource-level and conditional constraints, so the reported antichain widths are lower bounds.
What the evidence shows
- The question of least authority
This paper measures whether published authorization tables give each task one uniquely least-authority grant. Benchmarks that score over-privilege and systems that compute permissions must compare grants that both suffice for a task.
The authors ask whether Microsoft Graph and Google’s published tables always support that comparison, instead of assuming that one grant is smaller.
- Measure grants by operations
The authors order grants by the operations their permissions authorize, then enumerate the minimal grants that cover each task.
A task has multiple incomparable minima when no grant’s authorized operations are a subset of another’s. The authors generate tasks from vendor table structure, so the resulting counts describe those task families rather than observed agent workloads.
- Some tasks have several minima
The enumeration finds multiple minimal grants in both catalogues, but at different rates across their generated task families. For Microsoft Graph, the rate is 29.8% for DelegatedWork and 30.7% for Application endpoint-group tasks.
For Google, 3.2% of resource-set tasks and 3.4–4.0% of random method-subset tasks have multiple incomparable minima. These are shares of tasks within each family.
- Scales can hide the choice
The paper then checks how an ordinal privilege scale handles those competing grants. Microsoft’s scale gives many incomparable Graph pairs equal ratings, but it also ties comparable pairs from the same tasks.
Applying a reconstructed verb-only ladder to the same Graph pairs produces still more equal ratings, showing that the scale affects how often the choice is hidden.
- The choice carries risk
Four risk measures sometimes rank the same incomparable grants in opposite directions, so a single smaller-grant ranking does not fit every measure. In a separate closed-choice study, six models usually selected a minimal grant from mixed pools, yet some choices were dominated across the four measures.
The authors therefore recommend reporting which minimal grant was chosen, alongside whether it was minimal.
Deep
- Original paper authors
- Xin Xu
- Submitted to arXiv
- License
- arXiv non-exclusive