Researchers framed the handoff between an AI agent's reasoning and its tools as a control problem. Each action must hold tokens for capability, approval, and budget. Prompt-injected requests missing those tokens are refused, no matter how they are worded.
AI agents now book, buy, send, and deploy on our behalf, and prompt injection — hidden text that hijacks their tools — is a real attack. This work puts the guardrails outside the model's judgment: permissions are enforced mechanically and can be formally checked, and it identifies the narrowest limits that still keep a deployment safe.
✦ The safest AI may be the one that has to show permission before it acts.