Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices

[2603.17170] Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices Skip to main content Search Submit Donate Log in Computer Science > Cryptography and Security arXiv:2603.17170 (cs) [Submitted on 17 Mar 2026 ( v1 ), last revised 25 Aug 2026 (this version, v2)] Title: Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices Authors: Reshabh K Sharma , Linxi Jiang , Shuo Chen , Zhiqiang Lin View PDF HTML (experimental) Abstract: AI agents increasingly execute users' natural-language (NL) tasks by calling Web services, yet today's Web authorizes these calls through OAuth, which grants permissions over operators (e.g., TRANSFER), not operations (operator plus operands, e.g., transfer $100 to Bob). This gap cannot be closed by refining scope granularity, because operands are combinatorial, quantitative, and often derived from runtime computations across servers. Operator-scoped authorization therefore inherently overprivileges agents. We propose Precise Task-Scoped Implicit Authorization (PAuth): submitting a concrete NL task implicitly authorizes exactly the operations its faithful execution requires, even when the agent is compromised (e.g., by malware or prompt injection). Each server independently derives an NL slice, a symbolic specification of the expected call inspired by program slicing, and server-produced values are wrapped in signed envelopes that bind concrete values to symbolic provenance. Together, they enforce that every operation, not just the operator, is consistent with the user's task, closing the gap that OAuth leaves open. We evaluate PAuth on AuthBench, a benchmark we build on top of AgentDojo and cross-validate on OpenClaw, spanning five service suites with 100 benign tasks and 634 adversarial calls. All 100 benign tasks are implicitly authorized and all 634 adversarial calls are blocked. Many tasks require multiple tool calls to complete. A unique value of PAuth is that it frees users from having to approve each call with concrete operand values, including intermediate results they never specified. This enhances both security and usability. Subjects: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI); Programming Languages (cs.PL) Cite as: arXiv:2603.17170 [cs.CR] (or arXiv:2603.17170v2 [cs.CR] for this version) https://doi.org/10.48550/arXiv.2603.17170 Focus to learn more arXiv-issued DOI via DataCite Submission history From: Linxi Jiang [ view email ] [v1] Tue, 17 Mar 2026 22:05:03 UTC (668 KB) [v2] Tue, 25 Aug 2026 04:00:17 UTC (5,138 KB) Full-text links: Access Paper: View PDF HTML (experimental) TeX Source view license Current browse context: cs.CR < prev | next > new | recent | 2026-03 Change to browse by: cs cs.AI cs.PL References & Citations NASA ADS Google Scholar Semantic Scholar export BibTeX citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer ( What is the Explorer? ) Connected Papers Toggle Connected Papers ( What is Connected Papers? ) Litmaps Toggle Litmaps ( What is Litmaps? ) scite.ai Toggle scite Smart Citations ( What are Smart Citations? ) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv ( What is alphaXiv? ) Links to Code Toggle CatalyzeX Code Finder for Papers ( What is CatalyzeX? ) DagsHub Toggle DagsHub ( What is DagsHub? ) GotitPub Toggle Gotit.pub ( What is GotitPub? ) Huggingface Toggle Hugging Face ( What is Huggingface? ) ScienceCast Toggle ScienceCast ( What is ScienceCast? ) Demos Demos Replicate Toggle Replicate ( What is Replicate? ) Spaces Toggle Hugging Face Spaces ( What is Spaces? ) Spaces Toggle TXYZ.AI ( What is TXYZ.AI? ) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower ( What are Influence Flowers? ) Core recommender toggle CORE Recommender ( What is CORE? ) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs . Which authors of this paper are endorsers? | Disable MathJax ( What is MathJax? ) We gratefully acknowledge support from our major funders , member institutions , and all contributors. About · Help · Contact · Subscribe · Copyright · Privacy · Accessibility · Operational Status (opens in new tab) Major funding support from

Related documents

• Beyond OAuth: Task-Scoped Authorization for AI Agents via Natural Language Slices#670527
• Credentials That Carry Their Evidence: Credential design, dynamic tiering, and approved use when AI agents can do the work#469694
• Shared Language for Responsible AI Integration#283823
• Token Efficient Task Execution via Application Behavior Modeling for Web Agents#1071275
• Evaluating AI Models' Capability to Automate Voice Phishing Attacks#363202