arXiv：cs.AI· Huihao Jing, Shaojin Chen, Wenbin Hu, Yuxuan Liu, Haochen Shi, Zhongwei Xie, Haoran Li, Yangqiu Song·· 16 小时前
同一操作，不同权限：评估 Guardrail 是否遵循授权
Same Operation, Different Permission: Evaluating Whether Guardrails Honor Authorization
AI 导读
研究提出 \bench{} 基准，用专家标注的自然语言场景与已执行验证的操作，对比同一操作在授权证据下的决策表现，并追踪请求在 guardrail 变更下的变化。实验发现许多被拦截的操作源于审查失败而非正确拒绝：修复输出格式可恢复可用决策，但会改变被放行的授权请求；增加第二名审查者能消除部分错误，却会拒绝有效授权。研究者主张 guardrail 应同时评估其拦截的未授权操作与放行的已授权操作。
正文
Abstract:As language-model agents write code, move money and change records on behalf of users, deciding whether an action is authorized has become a central safety problem. Guardrails are often placed in front of these actions, yet few evaluations ask whether their decisions follow authorization: blocking unauthorized actions while still allowing the same actions under valid permission. We introduce \bench{}, a benchmark that contrasts authorization evidence for the same operation in its language track. It combines expert-annotated natural-language scenarios with executed and verified operations, plus externally sourced native-policy requests. \bench{} checks each decision for correctness, usability and resulting effect, and tracks each request across guardrail changes. Our experiments show that many blocked operations stem from failed reviews, not correct denials. Repairing the output format restores usable decisions but changes which authorized requests are honored, and adding a second reviewer removes some errors while rejecting valid authorization. Guardrails should therefore be evaluated on both the unauthorized actions they stop and the authorized actions they let through.
| Subjects: | Artificial Intelligence (cs.AI); Software Engineering (cs.SE) |
| Cite as: | arXiv:2610.16838 [cs.AI] |
| (or arXiv:2610.16838v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2610.16838 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Huihao Jing [view email]
[v1]
Mon, 12 Oct 2026 14:17:21 UTC (190 KB)
来源：arXiv：cs.AI · arxiv.org