Conflux: Preventing privilege escalation with principal context and system-level evaluation

The paper proposes Conflux, a principal-context defense for LLM agents that formalizes privilege escalation as a system-level safety goal: an action may be executed only if all principals affecting it would permit it. Its kernel ITES derives permissions from provenance information and the organization's existing access control system, and takes the intersection of permissions over each affecting principal. The authors prove a conditional permission constraint theorem: under conditions of full mediation, non-launderable provenance, known non-empty decision context, fresh permission checks, and action binding, the kernel will not allow an over-privileged action against any recorded affecting principal; the theorem covers the represented value-affecting portion, while control influences such as tool, branch, recipient, or plan-step selection remain obligations to be refined. The paper also presents two system-level evaluators: black-box SLED exhaustively explores up to a set bound within a declared finite defense model, and white-box SLED-V checks safety and provenance properties on a serializable intermediate representation. The appendix reports retained AgentDojo, SLED, and SLED-V results and runtime limitations, and states that no result constitutes a guarantee for unbounded deployment.