Protecting multi-tool AI agent chains with dynamic, real-time composition policies

The researchers propose the Dynamic Security Control Composer (DSCC), which uses a two-stage composition strategy to address the security problem in multi-tool AI agent chains that single-tool guardrails cannot cover: tools individually approved may violate organizational policy when combined. In the first stage, at session checkout, the Most Restrictive Set (MRS) algorithm composes the security policies of individual tools into a single effective policy; a monotonicity invariant guarantees that extending the chain only tightens the result, blocking incompatible combinations before tool execution, and tool outputs also propagate classification constraints into a session-level taint state. In the second stage, at runtime, a monotonic taint state tracks the sensitivity of data the agent has come into contact with, and revokes the session when accumulated exposure would cause subsequent tool calls to violate policy. The researchers evaluate on a reference implementation with 32 tools and 16 NIST SP 800-53-aligned policies; the default clearance mode blocks 79.2% of policy pairs and 95.5% of triples, while the alternative taint mode blocks 42.5% and 60.5%, respectively. The paper also discusses the governance implications of organizational deployment of multi-tool agents, including the trade-off between utility and security and the changes needed to implement chain-aware policies.