A Theory of Least Autonomy in AI

# A Theory of Least Autonomy in AI
Source: [https://arxiv.org/html/2607.09744](https://arxiv.org/html/2607.09744)
###### Abstract

Least privilege, the principle that an identity should hold only the permissions strictly required for its task, has been a foundational primitive of access control for decades\. We argue that this principle is insufficient for agentic AI systems, which do not merely hold permissions but can combine, approve, and amplify them across workflows and system boundaries\.

We propose*least autonomy*as an appropriate generalization and develop a formal theory\. First, we define a compositional blast radius d\(a,b\) that measures structural separation between actions in an enterprise hierarchy, combining an ultrametric tree with lattice\-valued confidentiality, integrity, and control\-context labels\. Second, we define a directed agent influence graph G\(theta\)\. An arc from U to V requires a directed shared\-resource write\-to\-read meeting or a conservative undirected agent\-to\-agent \(A2A\) communication meeting, and a meeting\-conditioned influence potential at or above an externally selected policy threshold theta\. A catalogue\-radius profile supports calibration and audit of theta\. Finally, we define a collusion predicate over graph reachability that detects authorization composition, decision manipulation, and cross\-domain capability composition\.

We provide a step\-by\-step design procedure, a structured comparison with classical least privilege, and an end\-to\-end illustrative example on a representative enterprise hierarchy\.

## 1Introduction

### 1\.1The Insufficiency of Least Privilege for Agentic AI

The principle of least privilege, formalized in the 1970s\[[12](https://arxiv.org/html/2607.09744#bib.bib12)\], instructs that every principal should hold only the permissions necessary to accomplish its designated function\. For human users and traditional software processes, this principle has provided a durable basis for access\-control design\. Its application is more difficult for agentic AI systems, whose actions may be sequenced, delegated, and composed across workflows and system boundaries\.

An agent is not merely a passive accessor of resources\. It may read an output, transform it, write to a downstream resource, trigger a workflow, approve a privilege elevation, or hand off a task to another agent\. Each individual permission in such a chain may appear innocuous in isolation, while the resulting configuration creates a risk not captured by a permission\-by\-permission review\.

Two properties of agentic systems make this particularly important:

1. \(i\)Gatekeeping\.An agent may lack direct access to sensitive data while retaining authority to approve or enable another principal’s access\. Conventional permission reviews need not capture this control\-plane influence\.
2. \(ii\)Composition\.An agent’s operational reach may depend not only on its own direct permissions, but also on the actions of other agents that it can influence\.

Our framework supports both resource\-mediated meetings and direct agent\-to\-agent \(A2A\) communication meetings\. For A2A communication, the existence of a configured communication path is treated conservatively as an undirected meeting: even an apparently one\-way delegation channel may permit reverse influence through returned content, delegated artifacts, tool outputs, or prompt\-injection payloads\.

### 1\.2From Permissions to Autonomy

We propose shifting the unit of analysis from*permission*to*autonomy*\. Where least privilege asks, “What can this identity access?”, least autonomy asks, “What authority exposure can arise when this identity’s permissions compose with those of agents it can influence?”

Least autonomy does not replace conventional access control\. Rather, it is a complementary design criterion for identifying high\-impact resource\-mediated or communication\-mediated interactions and multi\-agent capability compositions that a permission\-by\-permission review may not reveal\.

We formalize autonomy through a risk structure\. The compositional blast radiusd​\(a,b\)d\(a,b\)measures security distance between actions in an enterprise hierarchy\. The directed influence graph then lifts this action\-level structure to agents through meeting\-witnessed relationships\.

Under the paper’s conservative screening model, an agent’s effective autonomy includes the actions assigned to agents reachable through those directed influence relationships\. This is a capability\-exposure abstraction, not a claim that every influence path yields command authority, provenance, or realized execution\.

### 1\.3Contributions

This paper makes three contributions:

1. \(1\)A compositional blast radius\(Section[3](https://arxiv.org/html/2607.09744#S3)\) that combines an ultrametric enterprise hierarchy with a lattice of security labels\.
2. \(2\)A directed agent influence graph and collusion predicate\(Sections[4](https://arxiv.org/html/2607.09744#S4)–[5](https://arxiv.org/html/2607.09744#S5)\), in which arcs require either a directed shared\-resource meeting or a conservative undirected A2A communication meeting, together with an influence potential above an externally selected policy threshold\. The framework includes an auditable catalogue\-calibration profile, effective autonomy, and witnesses for authorization composition, decision manipulation, and cross\-domain composition\.
3. \(3\)A design procedure and comparison framework\(Section[6](https://arxiv.org/html/2607.09744#S6)\) that translates the model into guidance for security engineers\.

## 2Background and Related Work

### 2\.1Authorization Safety, Least Privilege, and Separation of Duty

Classical protection models distinguish a static authorization state from the more difficult question of whether a principal can acquire a right through permitted state transitions\. Harrison, Ruzzo, and Ullman’s protection model formalized this safety question, showing that right acquisition is generally difficult to decide without restricting the protection system\[[1](https://arxiv.org/html/2607.09744#bib.bib1)\]\. Role\-based access control \(RBAC\) subsequently provided a practical framework for organizing permissions through role–permission and user–role assignments, while supporting constraints such as least privilege and separation of duty\[[2](https://arxiv.org/html/2607.09744#bib.bib2)\]\. Kuhn studied mutual exclusion of roles as a mechanism for enforcing separation of duty and characterized conditions under which such controls are safe\[[3](https://arxiv.org/html/2607.09744#bib.bib3)\]\.

Our setting differs from traditional RBAC in that principals may be autonomous agents and permissions may compose through cross\-organizational interactions\. Nevertheless, the distinction between static authorization, authorization evolution, and task\-level constraints remains essential\.

### 2\.2Workflow Authorization and Policy Analysis

Authorization constraints in workflow systems address the fact that secure execution often depends not only on who possesses an individual permission, but also on which principal performs which task, in what sequence, and subject to what constraints\. Bertino, Ferrari, and Atluri formalized authorization constraints for workflow management systems, including constraints that restrict assignments and executions across workflow tasks\[[4](https://arxiv.org/html/2607.09744#bib.bib4)\]\. This literature is particularly relevant when write and read permissions are intended to represent a feasible business or system workflow rather than merely co\-occurring permissions\.

A complementary line of work concerns formal analysis of access\-control policies\. For example, Margrave supports verification and change\-impact analysis for access\-control policies\[[5](https://arxiv.org/html/2607.09744#bib.bib5)\]\. These approaches motivate treating the proposed criterion not only as a descriptive score, but as an analyzable policy property with explicit assumptions about policy semantics, workflow feasibility, and controls\.

### 2\.3Graph\-Based Security Analysis

Graph\-based security analysis has long represented multi\-step compromise and reachability through attack graphs\. Ammann, Wijesekera, and Kaushik developed graph\-based vulnerability analysis to reason about paths induced by network configuration and exploit conditions\[[6](https://arxiv.org/html/2607.09744#bib.bib6)\]; Sheyner et al\. similarly studied automated generation and analysis of attack graphs\[[7](https://arxiv.org/html/2607.09744#bib.bib7)\]\. These models differ from the present approach because their edges are justified by explicit preconditions and state transitions\.

The proposed influence graph instead aggregates permission relationships using resource\-hierarchy distance and security labels\. It should therefore be interpreted as a static authorization\-risk abstraction unless each retained edge is linked to a concrete feasible write\-to\-read workflow, provenance relation, or tool\-mediated transition\. Under such a relation, the metric can rank the severity of established channels\.

### 2\.4Lattice\-Based Information\-Flow Control

Denning’s foundational work\[[13](https://arxiv.org/html/2607.09744#bib.bib13)\]showed that information\-flow policies can be expressed using a lattice of security classes together with a*can\-flow\-to*relation\. Subsequent work in language\-based security\[[14](https://arxiv.org/html/2607.09744#bib.bib14)\]developed these ideas in programming\-language settings, including formal accounts of information\-flow enforcement\.

The present model does not claim a noninterference result or an enforcement theorem for information flow\. Rather, it uses a lattice\-valued label structure to accumulate confidentiality, integrity, and gatekeeping context along paths in an enterprise hierarchy\. The connection to lattice\-based flow control is therefore conceptual: both approaches treat security properties as compositional rather than as attributes of isolated permissions\.

### 2\.5Tool\-Enabled Agents and Privilege Control

Recent work shows that language\-model agents become security\-critical when they process untrusted external content while retaining authority to invoke consequential tools\. ToolEmu evaluates risks in tool\-mediated language\-model agents\[[15](https://arxiv.org/html/2607.09744#bib.bib15)\], while AgentDojo evaluates prompt\-injection attacks and defenses in realistic agent\-tool environments\[[8](https://arxiv.org/html/2607.09744#bib.bib8)\]\. More recent systems explicitly pursue least\-privilege enforcement for tool\-calling agents, including Prompt Flow Integrity\[[9](https://arxiv.org/html/2607.09744#bib.bib9)\], Progent\[[10](https://arxiv.org/html/2607.09744#bib.bib10)\], and MiniScope\[[11](https://arxiv.org/html/2607.09744#bib.bib11)\]\.

These systems focus primarily on runtime isolation, tool\-call authorization, or adversarial evaluation of individual agents\. In contrast, this paper studies a static design\-time question: how permissions distributed across multiple enterprise agents may combine across organizational scopes and security domains\. The contribution should therefore be framed as complementary to runtime tool authorization: the proposed analysis can identify permission configurations that merit runtime mediation, approval gates, or least\-privilege redesign\.

## 3The Resource Hierarchy and Blast Radius

### 3\.1Enterprise Hierarchy as an Ultrametric Tree

We model the enterprise information system as a rooted tree𝒯=\(N,ET\)\\mathcal\{T\}=\(N,E\_\{T\}\), where leaf nodes correspond to individual resources and internal nodes to organizational scopes\. We assign depthD​\(v\)∈ℕ0D\(v\)\\in\\mathbb\{N\}\_\{0\}to each node, withD​\(root\)=0D\(\\mathrm\{root\}\)=0\.

The tree induces a natural ultrametric: Foru,v∈Nu,v\\in N, define

ultra⁡\(u,u\):=0,\\operatorname\{ultra\}\(u,u\):=0,and, foru≠vu\\neq v, define

ultra⁡\(u,v\):=2−\(2​D​\(lca⁡\(u,v\)\)\+1\)\.\\operatorname\{ultra\}\(u,v\):=2^\{\-\\left\(2D\\\!\\bigl\(\\operatorname\{lca\}\(u,v\)\\bigr\)\+1\\right\)\}\.This satisfies the strong triangle inequality and decreases by a factor of 4 for each additional depth level of the LCA, a property exploited in Section[3\.3](https://arxiv.org/html/2607.09744#S3.SS3)to bound the lattice multiplier\.

### 3\.2The Action Permission Model

Each actiona∈𝒜a\\in\\mathcal\{A\}is an admissible action instance

a=\(v,𝐶𝐹,𝑅𝑃,𝑆𝑆,𝑂𝑝\),a=\(v,\\mathit\{CF\},\\mathit\{RP\},\\mathit\{SS\},\\mathit\{Op\}\),wherev∈Nv\\in Nis the associated resource node,𝐶𝐹\\mathit\{CF\}is the control\-flow classification,𝑅𝑃\\mathit\{RP\}is the resource\-provider class,𝑆𝑆\\mathit\{SS\}is the sensitivity class, and𝑂𝑝\\mathit\{Op\}is the operation\. Define

node⁡\(a\):=v\.\\operatorname\{node\}\(a\):=v\.

### 3\.3The Sensitivity Lattice

###### Definition 3\.2\(Local label\)\.

For each nodev∈Nv\\in N, the*local label*isℓ​\(v\)=\(𝑓𝑙𝑜𝑤,𝑎𝑥𝑒𝑠\)\\ell\(v\)=\(\\mathit\{flow\},\\,\\mathit\{axes\}\)where

𝑓𝑙𝑜𝑤∈\{∅,G​K,A​c\},∅<G​K<A​c,𝑎𝑥𝑒𝑠⊆\{C,I\},\\mathit\{flow\}\\in\\\{\\emptyset,GK,Ac\\\},\\qquad\\emptyset<GK<Ac,\\qquad\\mathit\{axes\}\\subseteq\\\{C,I\\\},with

𝑓𝑙𝑜𝑤=∅⟹𝑎𝑥𝑒𝑠=∅\.\\mathit\{flow\}=\\emptyset\\Longrightarrow\\mathit\{axes\}=\\emptyset\.

The node\-level coordinate𝑓𝑙𝑜𝑤\\mathit\{flow\}is a policy\-label attribute and is distinct from the action\-level classification𝐶𝐹​\(a\)\\mathit\{CF\}\(a\)\.

This yields nine possible labels shown in Figure[1](https://arxiv.org/html/2607.09744#S3.F1)\.

Figure 1:Local label encoding lattice\.L0L\_\{0\}\(∅,∅\)\(\\emptyset,\\emptyset\)L1L\_\{1\}\(G​K,∅\)\(GK,\\emptyset\)L3​CL\_\{3C\}\(G​K,\{C\}\)\(GK,\\\{C\\\}\)L2L\_\{2\}\(A​c,∅\)\(Ac,\\emptyset\)L3​IL\_\{3I\}\(G​K,\{I\}\)\(GK,\\\{I\\\}\)L5​CL\_\{5C\}\(A​c,\{C\}\)\(Ac,\\\{C\\\}\)L4L\_\{4\}\(G​K,\{C,I\}\)\(GK,\\\{C,I\\\}\)L5​IL\_\{5I\}\(A​c,\{I\}\)\(Ac,\\\{I\\\}\)L6L\_\{6\}\(A​c,\{C,I\}\)\(Ac,\\\{C,I\\\}\)L3​CL\_\{3C\}andL3​IL\_\{3I\}are incomparable; so areL5​CL\_\{5C\}andL5​IL\_\{5I\}\. The*join operator*⊗\\otimesis defined componentwise:

\(f1,A1\)⊗\(f2,A2\):=\(max⁡\(f1,f2\),A1∪A2\)\.\(f\_\{1\},A\_\{1\}\)\\otimes\(f\_\{2\},A\_\{2\}\):=\\bigl\(\\max\(f\_\{1\},f\_\{2\}\),\\;A\_\{1\}\\cup A\_\{2\}\\bigr\)\.The join is commutative, associative, and idempotent\.

### 3\.4Path\-Accumulated Labels

###### Definition 3\.3\(Path\-accumulated label\)\.

For any nodev∈Nv\\in N, letπ​\(v\)\\pi\(v\)be the path from root tovv\. The*path\-accumulated label*is:J​\(v\)=⋁u∈π​\(v\)ℓ​\(u\)J\(v\)=\\bigvee\_\{u\\in\\pi\(v\)\}\\ell\(u\)\.

The join correctly detects when confidentiality and integrity risks accumulate jointly: for example, suppose that an ancestoruuof a resource nodevvhas local label

ℓ​\(u\)=L3​C=\(G​K,\{C\}\),\\ell\(u\)=L\_\{3C\}=\(GK,\\\{C\\\}\),thatvvhas local label

ℓ​\(v\)=L3​I=\(G​K,\{I\}\),\\ell\(v\)=L\_\{3I\}=\(GK,\\\{I\\\}\),and that every other node onπ​\(v\)\\pi\(v\)has labelL0L\_\{0\}\. Then

J​\(v\)\\displaystyle J\(v\)=L3​C⊗L3​I\\displaystyle=L\_\{3C\}\\otimes L\_\{3I\}=\(G​K,\{C\}\)⊗\(G​K,\{I\}\)\\displaystyle=\(GK,\\\{C\\\}\)\\otimes\(GK,\\\{I\\\}\)=\(max⁡\{G​K,G​K\},\{C\}∪\{I\}\)\\displaystyle=\\bigl\(\\max\\\{GK,GK\\\},\\\{C\\\}\\cup\\\{I\\\}\\bigr\)=\(G​K,\{C,I\}\)\\displaystyle=\(GK,\\\{C,I\\\}\)=L4\.\\displaystyle=L\_\{4\}\.Thus, the accumulated label records that both confidentiality and integrity sensitivity occur along the path tovv, even though neither local label alone isL4L\_\{4\}\.

### 3\.5From Labels to Multipliers

We assign a multiplierF​\(ℓ\)∈\[1,2\]F\(\\ell\)\\in\[1,2\]to each label, monotone with respect to the lattice order\. Labels related by the confidentiality–integrity symmetry receive equal values \(in particular,L3​CL\_\{3\}CandL3​IL\_\{3\}I, andL5​CL\_\{5\}CandL5​IL\_\{5\}I\); other incomparable labels may receive different policy values\. This avoids privileging confidentiality over integrity while preserving monotonicity\.

Table 1:Lattice labels and their multipliers\.
### 3\.6The Compositional Blast Radius

Let

node:𝒜→N\\operatorname\{node\}:\\mathcal\{A\}\\to Nmap each action to its associated resource node in the enterprise tree𝒯\\mathcal\{T\}\.

###### Definition 3\.5\(Compositional blast radius\)\.

For actionsa,b∈𝒜a,b\\in\\mathcal\{A\}, let

ua:=node⁡\(a\),ub:=node⁡\(b\)\.u\_\{a\}:=\\operatorname\{node\}\(a\),\\qquad u\_\{b\}:=\\operatorname\{node\}\(b\)\.
ExtendFFto pairs of accumulated labels by

F​\(ℓ1,ℓ2\):=max⁡\{F​\(ℓ1\),F​\(ℓ2\)\},ℓ1,ℓ2∈ℒ\.F\(\\ell\_\{1\},\\ell\_\{2\}\):=\\max\\\!\\left\\\{F\(\\ell\_\{1\}\),F\(\\ell\_\{2\}\)\\right\\\},\\qquad\\ell\_\{1\},\\ell\_\{2\}\\in\\mathcal\{L\}\.Thus,

F​\(J​\(ua\),J​\(ub\)\)=max⁡\{F​\(J​\(ua\)\),F​\(J​\(ub\)\)\}\.F\\\!\\bigl\(J\(u\_\{a\}\),J\(u\_\{b\}\)\\bigr\)=\\max\\\!\\left\\\{F\\\!\\bigl\(J\(u\_\{a\}\)\\bigr\),F\\\!\\bigl\(J\(u\_\{b\}\)\\bigr\)\\right\\\}\.
The*compositional blast radius*betweenaaandbbis

d𝒜​\(a,b\):=F​\(J​\(ua\),J​\(ub\)\)⋅ultra⁡\(ua,ub\)\.d\_\{\\mathcal\{A\}\}\(a,b\):=F\\\!\\bigl\(J\(u\_\{a\}\),J\(u\_\{b\}\)\\bigr\)\\cdot\\operatorname\{ultra\}\(u\_\{a\},u\_\{b\}\)\.For brevity, writed​\(a,b\):=d𝒜​\(a,b\)d\(a,b\):=d\_\{\\mathcal\{A\}\}\(a,b\)\.

The distanced𝒜d\_\{\\mathcal\{A\}\}measures hierarchical and sensitivity\-weighted*structural span*; it is not an operation\-severity metric\. In particular, actions associated with the same resource node have zero structural distance even when their operations differ\. Operation type and control\-flow classification are instead used elsewhere in the policy catalogue and collusion analysis\.

The functiond𝒜d\_\{\\mathcal\{A\}\}is symmetric\. Since distinct actions may be associated with the same resource node, it is a pseudoultrametric on actions: distinct actions at the same node have blast radius zero\. Its induced function on resource nodes satisfies the ultrametric strong triangle inequality, as proved in Appendix[A](https://arxiv.org/html/2607.09744#A1)\.

## 4The Agent Influence Graph

### 4\.1Meetings and Influence Potentials

Let𝒰\\mathcal\{U\}be the set of agents\. Let𝒜pol\\mathcal\{A\}\_\{\\mathrm\{pol\}\}be a finite, agent\-independent catalogue of admissible action instances, each consisting of a resource node, control\-flow classification, and operation, determined by the enterprise resource topology and policy\. For each agentU∈𝒰U\\in\\mathcal\{U\}, assume

𝒜​\(U\)⊆𝒜pol\.\\mathcal\{A\}\(U\)\\subseteq\\mathcal\{A\}\_\{\\mathrm\{pol\}\}\.
Define the write and read action sets ofUUby

𝒲​\(U\):=\{a∈𝒜​\(U\):𝑂𝑝​\(a\)=Write\},ℛ​\(U\):=\{a∈𝒜​\(U\):𝑂𝑝​\(a\)=Read\}\.\\mathcal\{W\}\(U\):=\\\{a\\in\\mathcal\{A\}\(U\):\\mathit\{Op\}\(a\)=\\mathrm\{Write\}\\\},\\qquad\\mathcal\{R\}\(U\):=\\\{a\\in\\mathcal\{A\}\(U\):\\mathit\{Op\}\(a\)=\\mathrm\{Read\}\\\}\.
###### Definition 4\.1\(Directed resource\-meeting witnesses\)\.

ForU,V∈𝒰U,V\\in\\mathcal\{U\}, define

ℳ​\(U,V\):=\{\(a,b\)∈𝒲​\(U\)×ℛ​\(V\):node⁡\(a\)=node⁡\(b\)\}\.\\mathcal\{M\}\(U,V\):=\\left\\\{\(a,b\)\\in\\mathcal\{W\}\(U\)\\times\\mathcal\{R\}\(V\):\\operatorname\{node\}\(a\)=\\operatorname\{node\}\(b\)\\right\\\}\.AgentsUUandVVhave a directed resource meeting when

RMeet​\(U,V\)⇔ℳ​\(U,V\)≠∅\.\\mathrm\{RMeet\}\(U,V\)\\iff\\mathcal\{M\}\(U,V\)\\neq\\varnothing\.

###### Definition 4\.2\(Undirected A2A meeting\)\.

Let

𝒞A2A⊆\{\{U,V\}:U,V∈𝒰,U≠V\}\\mathcal\{C\}\_\{\\mathrm\{A2A\}\}\\subseteq\\bigl\\\{\\\{U,V\\\}:U,V\\in\\mathcal\{U\},\\ U\\neq V\\bigr\\\}be the policy relation of agent pairs for which direct communication is possible\. Define

A2AMeet​\(U,V\)⇔\{U,V\}∈𝒞A2A\.\\mathrm\{A2AMeet\}\(U,V\)\\iff\\\{U,V\\\}\\in\\mathcal\{C\}\_\{\\mathrm\{A2A\}\}\.Hence,

A2AMeet​\(U,V\)⇔A2AMeet​\(V,U\)\.\\mathrm\{A2AMeet\}\(U,V\)\\iff\\mathrm\{A2AMeet\}\(V,U\)\.

###### Definition 4\.3\(Meeting\)\.

ForU,V∈𝒰U,V\\in\\mathcal\{U\}, define

Meet​\(U,V\)⇔RMeet​\(U,V\)∨A2AMeet​\(U,V\)\.\\mathrm\{Meet\}\(U,V\)\\iff\\mathrm\{RMeet\}\(U,V\)\\lor\\mathrm\{A2AMeet\}\(U,V\)\.

For action setsB,C⊆𝒜polB,C\\subseteq\\mathcal\{A\}\_\{\\mathrm\{pol\}\}, define

Span⁡\(B,C\):=\{max⁡\{d𝒜​\(a,b\):a∈B,b∈C\},B×C≠∅,0,B×C=∅\.\\operatorname\{Span\}\(B,C\):=\\begin\{cases\}\\displaystyle\\max\\\{d\_\{\\mathcal\{A\}\}\(a,b\):a\\in B,\\ b\\in C\\\},&B\\times C\\neq\\varnothing,\\\\\[4\.0pt\] 0,&B\\times C=\\varnothing\.\\end\{cases\}
###### Definition 4\.4\(Influence potential\)\.

ForU,V∈𝒰U,V\\in\\mathcal\{U\}, define

Φres​\(U→V\):=\{Span⁡\(𝒲​\(U\),ℛ​\(V\)\),RMeet​\(U,V\),0,otherwise,\\Phi\_\{\\mathrm\{res\}\}\(U\\to V\):=\\begin\{cases\}\\operatorname\{Span\}\(\\mathcal\{W\}\(U\),\\mathcal\{R\}\(V\)\),&\\mathrm\{RMeet\}\(U,V\),\\\\ 0,&\\text\{otherwise,\}\\end\{cases\}and

ΦA2A​\(U,V\):=\{Span⁡\(𝒜​\(U\),𝒜​\(V\)\),A2AMeet​\(U,V\),0,otherwise\.\\Phi\_\{\\mathrm\{A2A\}\}\(U,V\):=\\begin\{cases\}\\operatorname\{Span\}\(\\mathcal\{A\}\(U\),\\mathcal\{A\}\(V\)\),&\\mathrm\{A2AMeet\}\(U,V\),\\\\ 0,&\\text\{otherwise\.\}\\end\{cases\}The meeting\-conditioned influence potential is

Φ​\(U→V\):=max⁡\{Φres​\(U→V\),ΦA2A​\(U,V\)\}\.\\Phi\(U\\to V\):=\\max\\\{\\Phi\_\{\\mathrm\{res\}\}\(U\\to V\),\\Phi\_\{\\mathrm\{A2A\}\}\(U,V\)\\\}\.

### 4\.2The Thresholdθ\\thetaas a Policy Parameter

The thresholdθ\\thetais an enterprise policy parameter that determines which meeting\-conditioned influence potentials are sufficiently high impact to be represented as arcs in the influence graph\. It is selected by the security policy owner; it is not defined to be the maximum blast radius in the current catalogue or in any individual agent’s assigned permissions\.

The resource topology, path\-accumulated labels, multiplier functionFF, and agent\-independent policy catalogue provide calibration data for selecting and reviewingθ\\theta\. They do not mechanically determine its value\.

Let

ℒ≥3:=\{L3​C,L3​I,L4,L5​C,L5​I,L6\},\\mathcal\{L\}\_\{\\geq 3\}:=\\\{L\_\{3C\},L\_\{3I\},L\_\{4\},L\_\{5C\},L\_\{5I\},L\_\{6\}\\\},and let the material policy catalogue be

𝒜≥3:=\{a∈𝒜pol:J​\(node⁡\(a\)\)∈ℒ≥3\}\.\\mathcal\{A\}\_\{\\geq 3\}:=\\left\\\{a\\in\\mathcal\{A\}\_\{\\mathrm\{pol\}\}:J\\\!\\bigl\(\\operatorname\{node\}\(a\)\\bigr\)\\in\\mathcal\{L\}\_\{\\geq 3\}\\right\\\}\.Define the catalogue\-radius profile

ℛcal:=\{d𝒜​\(a,b\):a,b∈𝒜≥3,node⁡\(a\)≠node⁡\(b\)\}\.\\mathcal\{R\}\_\{\\mathrm\{cal\}\}:=\\left\\\{d\_\{\\mathcal\{A\}\}\(a,b\):a,b\\in\\mathcal\{A\}\_\{\\geq 3\},\\ \\operatorname\{node\}\(a\)\\neq\\operatorname\{node\}\(b\)\\right\\\}\.This finite set records the distinct nonzero blast\-radius levels available under the current enterprise hierarchy and materiality policy\.

The materiality rule is used here to calibrate and review the policy thresholdθ\\theta\. Unless stated otherwise, it does not restrict the write and read action sets used inΦ​\(U→V\)\\Phi\(U\\to V\): every authorized action of an interacting pair may contribute to that pair’s influence potential\.

The security policy specifies

θ∈\[0,\+∞\)\\theta\\in\[0,\+\\infty\)independently of the current agent assignments\. In selectingθ\\theta, a policy owner may useℛcal\\mathcal\{R\}\_\{\\mathrm\{cal\}\}to identify meaningful hierarchy and sensitivity boundaries, such as the smallest radius crossing a Finance–Engineering boundary, a chosen upper quantile of catalogue radii, or a documented organizational risk tolerance\. The selected value, its rationale, the materiality rule, and the catalogue version used for calibration should be retained as policy evidence\.

For a fixedθ\\theta, an influence potential is high impact when

Φ​\(U→V\)≥θ\.\\Phi\(U\\to V\)\\geq\\theta\.Thus, loweringθ\\thetaweakly enlarges the influence graph, whereas raisingθ\\thetaweakly removes arcs\. The threshold may be reconsidered when the topology, labels, materiality policy, or enterprise risk tolerance changes, but such a change is a policy decision rather than an automatic consequence of adding an action to the catalogue\.

The catalogue maximum remains useful as a calibration statistic:

rmax:=\{max⁡ℛcal,ℛcal≠∅,0,ℛcal=∅\.r\_\{\\max\}:=\\begin\{cases\}\\max\\mathcal\{R\}\_\{\\mathrm\{cal\}\},&\\mathcal\{R\}\_\{\\mathrm\{cal\}\}\\neq\\varnothing,\\\\\[4\.0pt\] 0,&\\mathcal\{R\}\_\{\\mathrm\{cal\}\}=\\varnothing\.\\end\{cases\}It bounds the largest blast radius represented by the material catalogue, but it is not, in general, equal toθ\\theta\.

### 4\.3The Influence Graph and Effective Autonomy

###### Definition 4\.6\(Influence graph\)\.

For a policy thresholdθ≥0\\theta\\geq 0, the influence graph is the directed graph

G​\(θ\)=\(𝒰,Eθ\),G\(\\theta\)=\\bigl\(\\mathcal\{U\},E\_\{\\theta\}\\bigr\),where

Eθ:=\{\(U,V\)∈𝒰×𝒰:U≠V,Meet​\(U,V\),Φ​\(U→V\)≥θ\}\.E\_\{\\theta\}:=\\left\\\{\(U,V\)\\in\\mathcal\{U\}\\times\\mathcal\{U\}:U\\neq V,\\;\\mathrm\{Meet\}\(U,V\),\\;\\Phi\(U\\to V\)\\geq\\theta\\right\\\}\.

An arcU→VU\\to Vhas two requirements\. First,Meet​\(U,V\)\\mathrm\{Meet\}\(U,V\)requires either a directed shared\-resource witness or an undirected A2A communication meeting\. Second,Φ​\(U→V\)≥θ\\Phi\(U\\to V\)\\geq\\thetarequires the relevant meeting\-conditioned influence potential to meet the policy threshold\.

A resource\-mediated arc retains a write–read witness\(ameet,bmeet\)∈ℳ​\(U,V\)\(a^\{\\mathrm\{meet\}\},b^\{\\mathrm\{meet\}\}\)\\in\\mathcal\{M\}\(U,V\)\. An A2A\-only arc retains the communicating agent pair\{U,V\}\\\{U,V\\\}as its meeting witness\.

For every arc\(U,V\)∈Eθ\(U,V\)\\in E\_\{\\theta\}, the analysis retains at least one meeting witness\. For a resource\-mediated arc, this is a write–read witness\(ameet,bmeet\)∈ℳ​\(U,V\)\(a^\{\\mathrm\{meet\}\},b^\{\\mathrm\{meet\}\}\)\\in\\mathcal\{M\}\(U,V\); for an A2A\-only arc, it is the communicating pair \{U,V\}\. When both conditions hold, both witness types may be retained\.

###### Definition 4\.7\(Weak projection and candidate\-coalition components\)\.

LetH=\(𝒰,EH\)H=\(\\mathcal\{U\},E\_\{H\}\)be a directed graph on the agent set𝒰\\mathcal\{U\}\. Its*weak projection*H¯\\overline\{H\}has an undirected edge\{U,V\}\\\{U,V\\\}whenever either\(U→V\)∈EH\(U\\to V\)\\in E\_\{H\}or\(V→U\)∈EH\(V\\to U\)\\in E\_\{H\}\.

Each non\-singleton weakly connected component ofH¯\\overline\{H\}is called a*candidate\-coalition component*\. A coalition under consideration is any set of at least two agents contained in one such component\.

Because the collusion predicate is witnessed by a pair of agents, testing all ordered pairs within each candidate\-coalition component is sufficient to detect every collusion\-positive subset; the implementation reports the containing component rather than enumerating all such subsets\.

###### Definition 4\.8\(Graph\-relative reachability and effective autonomy\)\.

LetH=\(𝒰,EH\)H=\(\\mathcal\{U\},E\_\{H\}\)be a directed graph on𝒰\\mathcal\{U\}\. WriteU↝HVU\\leadsto\_\{H\}Vwhen there is a directed path of positive length fromUUtoVVinHH\. WriteU↝H∗VU\\leadsto\_\{H\}^\{\*\}Vwhen eitherU=VU=VorU↝HVU\\leadsto\_\{H\}V\.

The*effective autonomy set*ofUUrelative toHHis

ℰH​\(U\):=⋃V∈𝒰U↝H∗V𝒜​\(V\)\.\\mathcal\{E\}\_\{H\}\(U\):=\\bigcup\_\{\\begin\{subarray\}\{c\}V\\in\\mathcal\{U\}\\\\ U\\leadsto\_\{H\}^\{\*\}V\\end\{subarray\}\}\\mathcal\{A\}\(V\)\.For a coalitionS⊆𝒰S\\subseteq\\mathcal\{U\}, define

ℰH​\(S\):=⋃U∈SℰH​\(U\)\.\\mathcal\{E\}\_\{H\}\(S\):=\\bigcup\_\{U\\in S\}\\mathcal\{E\}\_\{H\}\(U\)\.

The reflexive closure in this definition ensures that an agent’s effective autonomy includes its own directly assigned actions as well as the actions reachable through influence paths\.

### 4\.4Computational Complexity

Suppose there arennagents and each agent has at mostmmactions\. After standard preprocessing for constant\-time LCA queries, direct computation of all influence potentials examines at most

ordered write\-to\-read action pairs\. It therefore takes

time in the worst case\.

ConstructingG​\(θ\)G\(\\theta\)and its weak projection takesO​\(n2\+\|Eθ\|\)O\(n^\{2\}\+\|E\_\{\\theta\}\|\)time once the influence potentials are known\. Computing directed reachability by a graph search from every agent takes

O​\(n​\(n\+\|Eθ\|\)\)O\\bigl\(n\(n\+\|E\_\{\\theta\}\|\)\\bigr\)time, and henceO​\(n3\)O\(n^\{3\}\)in the worst case\.

Testing membership in𝒞A2A\\mathcal\{C\}\_\{\\mathrm\{A2A\}\}for all ordered agent pairs takesO​\(n2\)O\(n^\{2\}\)time with a relation matrix or hash\-based representation\. This does not change theO​\(n2​m2\)O\(n^\{2\}m^\{2\}\)worst\-case bound\.

A sharper bound requires additional structural assumptions or a specified indexing scheme for action locations\. In particular, noO​\(n2​m​Δ\)O\(n^\{2\}m\\Delta\)bound is claimed here without an explicit aggregation argument\.

The bounds above cover influence\-potential computation, graph construction, and reachability\. Full least\-autonomy evaluation additionally depends on the representation of effective\-action sets, sensitivity domains, gate relations, and collusion\-witness enumeration\.

## 5Collusion

The directed reachability relationU↝HVU\\leadsto\_\{H\}Vrecords a*model\-level potential influence path*fromUUtoVV\. It is not, by itself, a provenance\-preserving dataflow trace: successive arcs in a path may be witnessed by different resource write–read pairs or A2A communication meetings\. The relation is therefore used as a conservative screening condition for possible multi\-agent composition\.

### 5\.1Role Scopes and Gate Relations

###### Definition 5\.1\(Role scopes\)\.

ForU∈𝒰U\\in\\mathcal\{U\}, define the*approval scope*

𝒢​\(U\):=⋃a∈𝒜​\(U\)𝐶𝐹​\(a\)=G​Ksubtree​\(𝑛𝑜𝑑𝑒​\(a\)\),\\mathcal\{G\}\(U\):=\\bigcup\_\{\\begin\{subarray\}\{c\}a\\in\\mathcal\{A\}\(U\)\\\\ \\mathit\{CF\}\(a\)=GK\\end\{subarray\}\}\\mathrm\{subtree\}\(\\mathit\{node\}\(a\)\),and the*access scope*

𝒳​\(U\):=⋃a∈𝒜​\(U\)𝐶𝐹​\(a\)=A​csubtree​\(𝑛𝑜𝑑𝑒​\(a\)\)\.\\mathcal\{X\}\(U\):=\\bigcup\_\{\\begin\{subarray\}\{c\}a\\in\\mathcal\{A\}\(U\)\\\\ \\mathit\{CF\}\(a\)=Ac\\end\{subarray\}\}\\mathrm\{subtree\}\(\\mathit\{node\}\(a\)\)\.

Scope overlap alone does not establish that an approval action authorizes access to a resource\. Let

↝gate⊆N×N\\rightsquigarrow\_\{\\mathrm\{gate\}\}\\ \\subseteq\\ N\\times Nbe a security policy relation, where

g↝gatexg\\rightsquigarrow\_\{\\mathrm\{gate\}\}xmeans that approval authority associated with nodeggcan authorize, enable, or release access to the resource locationxx\.

###### Definition 5\.2\(Authorization relation\)\.

For agentsU,V∈𝒰U,V\\in\\mathcal\{U\}, write

Gates​\(U,V\)\\mathrm\{Gates\}\(U,V\)when there existg∈𝒢​\(U\)g\\in\\mathcal\{G\}\(U\)andx∈𝒳​\(V\)x\\in\\mathcal\{X\}\(V\)such that

g↝gatex\.g\\rightsquigarrow\_\{\\mathrm\{gate\}\}x\.

### 5\.2Sensitivity Domains

###### Definition 5\.3\(Sensitivity domain\)\.

A*sensitivity domain*is a policy\-defined subset of enterprise resource nodes\. Let

𝔇=\{𝒟1,…,𝒟m\}\\mathfrak\{D\}=\\left\\\{\\mathcal\{D\}\_\{1\},\\ldots,\\mathcal\{D\}\_\{m\}\\right\\\}be a family of nonempty, pairwise disjoint subsets ofNN\. Each𝒟i\\mathcal\{D\}\_\{i\}represents a security\-relevant operational domain, such as a production environment, a financial\-control boundary, or a regulated\-data environment\.

The domain family need not be inferred from sensitivity labels or from the topology of the enterprise tree\. It is specified by the security engineer and may reflect organizational, regulatory, deployment, or trust boundaries\.

For each nodev∈Nv\\in N, define

dom⁡\(v\)=\{i,v∈𝒟i​for some​i∈\{1,…,m\},⊥,v∉⋃i=1m𝒟i\.\\operatorname\{dom\}\(v\)=\\begin\{cases\}i,&v\\in\\mathcal\{D\}\_\{i\}\\text\{ for some \}i\\in\\\{1,\\ldots,m\\\},\\\\\[2\.0pt\] \\bot,&v\\notin\\displaystyle\\bigcup\_\{i=1\}^\{m\}\\mathcal\{D\}\_\{i\}\.\\end\{cases\}
A symmetric, irreflexive policy relation

⟂pol⊆\{1,…,m\}×\{1,…,m\}\\perp\_\{\\mathrm\{pol\}\}\\;\\subseteq\\;\\\{1,\\ldots,m\\\}\\times\\\{1,\\ldots,m\\\}specifies required separation between domains\. For distincti,j∈\{1,…,m\}i,j\\in\\\{1,\\ldots,m\\\},

i⟂polji\\perp\_\{\\mathrm\{pol\}\}jmeans that actions associated with resources in𝒟i\\mathcal\{D\}\_\{i\}and𝒟j\\mathcal\{D\}\_\{j\}are intended to remain separated\.

### 5\.3Collusion Predicate

We consider a conservative threat model in which agents may coordinate, share intermediate outputs, or exploit independently authorized capabilities outside a single predeclared workflow\. Accordingly, a risk witness need not be confined to one workflow identifier or one shared business process\.

The analysis does not claim that every witness corresponds to a currently implemented end\-to\-end workflow\. Rather, it identifies configurations in which directed influence and separately assigned control or access capabilities can be composed by cooperating, compromised, or improperly orchestrated agents\. Such a witness is sufficient to require policy review under the least\-autonomy criterion\.

Let

Loc​\(B\):=\{node⁡\(a\):a∈B\}\\mathrm\{Loc\}\(B\):=\\\{\\operatorname\{node\}\(a\):a\\in B\\\}for every action setB⊆𝒜B\\subseteq\\mathcal\{A\}\.

###### Definition 5\.4\(Collusion predicate\)\.

LetH=\(𝒰,EH\)H=\(\\mathcal\{U\},E\_\{H\}\)be a directed graph on the agent set𝒰\\mathcal\{U\}\. For any setS⊆𝒰S\\subseteq\\mathcal\{U\}with\|S\|≥2\|S\|\\geq 2, the predicateColludeH​\(S\)\\mathrm\{Collude\}\_\{H\}\(S\)holds if and only if there exist distinct agentsU,V∈SU,V\\in Ssatisfying at least one of the following conditions:

1. \(i\)Gates​\(U,V\)andU↝HV\\mathrm\{Gates\}\(U,V\)\\quad\\text\{and\}\\quad U\\leadsto\_\{H\}V\(authorization composition\);
2. \(ii\)Gates​\(U,V\)andV↝HU\\mathrm\{Gates\}\(U,V\)\\quad\\text\{and\}\\quad V\\leadsto\_\{H\}U\(decision manipulation\);
3. \(iii\)and there exist indices\(i,j\)\(i,j\)with i⟂polj,Loc​\(ℰH​\(U\)\)∩𝒟i≠∅,Loc​\(ℰH​\(V\)\)∩𝒟j≠∅i\\perp\_\{\\mathrm\{pol\}\}j,\\qquad\\mathrm\{Loc\}\(\\mathcal\{E\}\_\{H\}\(U\)\)\\cap\\mathcal\{D\}\_\{i\}\\neq\\varnothing,\\qquad\\mathrm\{Loc\}\(\\mathcal\{E\}\_\{H\}\(V\)\)\\cap\\mathcal\{D\}\_\{j\}\\neq\\varnothing\(cross\-domain exposure composition\)\.

Clause \(iii\) is intentionally a conservative reachable\-capability test\. Because effective autonomy is monotone along directed reachability, the two separated\-domain capabilities may be assigned to the same reachable agent\. Accordingly, clause \(iii\) identifies cross\-domain exposure within an influence\-connected configuration; unlike clauses \(i\) and \(ii\), it does not require each witness agent to contribute a distinct domain capability\.

###### Proposition 5\.7\(Collusion monotonicity\)\.

LetS,S′⊆𝒰S,S^\{\\prime\}\\subseteq\\mathcal\{U\}with\|S\|≥2\|S\|\\geq 2andS⊆S′S\\subseteq S^\{\\prime\}\. Then:

1. \(i\)IfColludeG​\(θ\)​\(S\)\\mathrm\{Collude\}\_\{G\(\\theta\)\}\(S\)andθ′≤θ\\theta^\{\\prime\}\\leq\\theta, then ColludeG​\(θ′\)​\(S\)\.\\mathrm\{Collude\}\_\{G\(\\theta^\{\\prime\}\)\}\(S\)\.
2. \(ii\)IfColludeG​\(θ\)​\(S\)\\mathrm\{Collude\}\_\{G\(\\theta\)\}\(S\), then ColludeG​\(θ\)​\(S′\)\.\\mathrm\{Collude\}\_\{G\(\\theta\)\}\(S^\{\\prime\}\)\.

###### Proof\.

For \(i\), decreasing the threshold fromθ\\thetatoθ′\\theta^\{\\prime\}can only add arcs toG​\(θ\)G\(\\theta\), since

Φ​\(U→V\)≥θ⟹Φ​\(U→V\)≥θ′\.\\Phi\(U\\to V\)\\geq\\theta\\quad\\Longrightarrow\\quad\\Phi\(U\\to V\)\\geq\\theta^\{\\prime\}\.Hence every directed\-reachability witness remains valid, and each effective autonomy setℰG​\(θ\)​\(U\)\\mathcal\{E\}\_\{G\(\\theta\)\}\(U\)can only grow whenθ\\thetais lowered\. The authorization and domain conditions are independent of the threshold, so the original collusion witness persists\.

For \(ii\), the same distinct witness agentsU,V∈SU,V\\in Salso belong toS′S^\{\\prime\}\. Thus the conditions witnessingColludeG​\(θ\)​\(S\)\\mathrm\{Collude\}\_\{G\(\\theta\)\}\(S\)also witnessColludeG​\(θ\)​\(S′\)\\mathrm\{Collude\}\_\{G\(\\theta\)\}\(S^\{\\prime\}\)\. ∎

## 6Least Autonomy as a Design Criterion

### 6\.1The Three\-Layer Theory

The framework operates at three related layers:

1. \(1\)Action layer\.The blast radiusd​\(a,b\)d\(a,b\)measures the structural security distance between actions\.
2. \(2\)Agent layer\.The influence potentialΦ​\(U→V\)\\Phi\(U\\to V\)and directed graphG​\(θ\)G\(\\theta\)represent potential influence among organizationally distant agents\.
3. \(3\)System layer\.The collusion predicate identifies specific multi\-agent policy violations within the operational graph\.

#### Two policy parameters\.

The thresholdθ\\thetaand the individual\-autonomy budgetτaut\\tau\_\{\\mathrm\{aut\}\}serve different purposes\. The thresholdθ\\thetaselects the high\-impact meeting\-conditioned relations represented in the influence graphG​\(θ\)G\(\\theta\)\. It does not constrain direct assignments of actions to one agent\. The separate policy parameterτaut\\tau\_\{\\mathrm\{aut\}\}bounds the blast radius of the action pairs that one agent may hold directly or acquire through autonomous influence\.

###### Definition 6\.1\(Individual blast\-radius bound\)\.

LetHHbe an influence graph and let

τaut≥0\\tau\_\{\\mathrm\{aut\}\}\\geq 0be an individual\-autonomy budget\. An agentU∈𝒰U\\in\\mathcal\{U\}satisfies the*individual blast\-radius bound*at budgetτaut\\tau\_\{\\mathrm\{aut\}\}when

∀a,b∈ℰH​\(U\),a≠b⟹d𝒜​\(a,b\)≤τaut\.\\forall a,b\\in\\mathcal\{E\}\_\{H\}\(U\),\\qquad a\\neq b\\ \\Longrightarrow\\ d\_\{\\mathcal\{A\}\}\(a,b\)\\leq\\tau\_\{\\mathrm\{aut\}\}\.Equivalently, wheneverℰH​\(U\)\\mathcal\{E\}\_\{H\}\(U\)contains at least two distinct actions,

max⁡\{d𝒜​\(a,b\):a,b∈ℰH​\(U\),a≠b\}≤τaut\.\\max\\\!\\left\\\{d\_\{\\mathcal\{A\}\}\(a,b\):a,b\\in\\mathcal\{E\}\_\{H\}\(U\),\\ a\\neq b\\right\\\}\\leq\\tau\_\{\\mathrm\{aut\}\}\.

### 6\.2Least Autonomy Condition

The operational graph records potential autonomous influence\. A system should permit such influence only where it is explicitly authorized\.

Let

𝖠𝗅𝗅𝗈𝗐⊆𝒰×𝒰\\mathsf\{Allow\}\\subseteq\\mathcal\{U\}\\times\\mathcal\{U\}be the policy relation of agent pairs for which autonomous influence is permitted\.

###### Definition 6\.2\(Least autonomy condition\)\.

A system satisfies*least autonomy*at policy parameters

\(θ,τaut\)\\bigl\(\\theta,\\tau\_\{\\mathrm\{aut\}\}\\bigr\)if:

1. \(a\)every agent satisfies the individual blast\-radius bound in the influence graph: ∀U∈𝒰,∀a,b∈ℰG​\(θ\)​\(U\),a≠b⟹d𝒜​\(a,b\)≤τaut;\\forall U\\in\\mathcal\{U\},\\quad\\forall a,b\\in\\mathcal\{E\}\_\{G\(\\theta\)\}\(U\),\\quad a\\neq b\\ \\Longrightarrow\\ d\_\{\\mathcal\{A\}\}\(a,b\)\\leq\\tau\_\{\\mathrm\{aut\}\};
2. \(b\)every influence arc is explicitly authorized: ∀\(U,V\)∈Eθ,\(U,V\)∈𝖠𝗅𝗅𝗈𝗐;\\forall\(U,V\)\\in E\_\{\\theta\},\\qquad\(U,V\)\\in\\mathsf\{Allow\};
3. \(c\)no set of distinct agents has a collusion witness in the graph: ColludeG​\(θ\)​\(S\)=falsefor every​S⊆𝒰​with​\|S\|≥2\.\\mathrm\{Collude\}\_\{G\(\\theta\)\}\(S\)=\\mathrm\{false\}\\qquad\\text\{for every \}S\\subseteq\\mathcal\{U\}\\text\{ with \}\|S\|\\geq 2\.

Condition \(a\) is logically independent of conditions \(b\) and \(c\)\. An agent can violate the individual blast\-radius bound through direct permission assignments alone, even when it has no incoming or outgoing influence arc\. Conversely, authorization and the absence of a collusion witness do not limit the concentration of harmful capability inside one effective\-autonomy set\. The three conditions therefore control distinct risks: individual concentration of authority, unauthorized autonomous influence, and harmful multi\-agent composition\.

### 6\.3Hierarchical Partitioning

The ultrametric hierarchy supports a useful partitioning strategy, but it does not by itself solve the least\-autonomy problem\. Security domains may be organized as subtrees of𝒯\\mathcal\{T\}, and the blast\-radius metric helps identify direct influence relations likely to cross domain boundaries\.

However, direct partitioning must be followed by analysis of the graph, because influence may compose through intermediate agents\. In particular, requiring cross\-domain direct influence potentials to remain belowθ\\thetais helpful but does not by itself rule out multi\-hop paths or gatekeeping relationships\. The least\-autonomy condition therefore combines domain design with explicit authorization, and collusion analysis\.

### 6\.4Step\-by\-Step Design Procedure

Steps 1–4 establish the resource and policy model\. The remaining steps are repeated whenever permissions, resources, or workflow gates change\.

1. Step 1\.Construct the resource hierarchy and policy catalogue\.Define the enterprise tree𝒯\\mathcal\{T\}, identify resource locations, and construct the agent\-independent action catalogue𝒜pol\\mathcal\{A\}\_\{\\mathrm\{pol\}\}\.
2. Step 2\.Classify resource providers and assign local labels\.Tag each provider as Standard, C, I, or CI, then assign the corresponding local labelsℓ​\(v\)\\ell\(v\)to hierarchy nodes\.
3. Step 3\.Configure policy relations\.Specify high\-sensitivity nodes, sensitivity domains, the separation relation⟂pol\\perp\_\{\\mathrm\{pol\}\}, the gate relation↝gate\\rightsquigarrow\_\{\\mathrm\{gate\}\}, the undirected A2A communication relation𝒞A2A\\mathcal\{C\}\_\{\\mathrm\{A2A\}\}, and the authorized agent\-pair relation𝖠𝗅𝗅𝗈𝗐\\mathsf\{Allow\}\.
4. Step 4\.Set and document the policy parameters\.Selectθ\\thetafrom the enterprise’s risk tolerance and intended cross\-scope control boundary\. Use the material catalogue\-radius profileℛcal\\mathcal\{R\}\_\{\\mathrm\{cal\}\}to calibrate and justify that selection\. Separately selectτaut\\tau\_\{\\mathrm\{aut\}\}as the maximum authority span that one agent may hold directly or acquire through autonomous influence\. Reassess both parameters when the policy model or risk tolerance changes\.
5. Step 5\.Compute meetings and influence potentials\.ComputeJ​\(v\)J\(v\)by a root\-to\-leaf traversal\. For each ordered agent pair, determine whether it has a directed resource meeting, an undirected A2A meeting, or both\. Use preprocessed LCA queries to compute the corresponding meeting\-conditioned influence potentialΦ​\(U→V\)\\Phi\(U\\to V\)\.
6. Step 6\.Construct the influence graph\.BuildG​\(θ\)G\(\\theta\), its weak projection, and its non\-singleton candidate\-coalition components\.
7. Step 7\.Evaluate least autonomy and iterate\.Compute directed reachability and effective autonomy inG​\(θ\)G\(\\theta\)\. Check the individual blast\-radius bound for every agent, verify that every arc\(U,V\)∈Eθ\(U,V\)\\in E\_\{\\theta\}satisfies\(U,V\)∈𝖠𝗅𝗅𝗈𝗐\(U,V\)\\in\\mathsf\{Allow\}, and evaluate the collusion predicate for each candidate\-coalition component\. Where a condition fails, revise direct permissions, the authorization relation, workflow design, hierarchy, or policy thresholds, then recompute the graph\.

### 6\.5Least Privilege vs\. Least Autonomy

Table 2:Least privilege and least autonomy\.

## 7Illustrative Example

This example uses only the action sets and role scopes already defined in the main text\. In particular, it does not introduce interface\-specific action subsets: directed meetings and influence potentials use𝒲​\(U\)\\mathcal\{W\}\(U\),ℛ​\(U\)\\mathcal\{R\}\(U\), andΦ​\(U→V\)\\Phi\(U\\to V\)exactly as in Section[4](https://arxiv.org/html/2607.09744#S4); approval and access relations use𝒢​\(U\)\\mathcal\{G\}\(U\),𝒳​\(U\)\\mathcal\{X\}\(U\), and↝gate\\rightsquigarrow\_\{\\mathrm\{gate\}\}exactly as in Section[5\.1](https://arxiv.org/html/2607.09744#S5.Thmtheorem1)\.

The example exercises only the resource\-mediated branch of the generalized meeting definition\. No A2A communication pair is included in𝒞A2A\\mathcal\{C\}\_\{\\mathrm\{A2A\}\}\.

### 7\.1Hierarchy, Labels, and Policy Parameters

The enterprise tree has rootTTat depth0\. At depth11, it separates into Operations and Corporate\. At depth22, Operations separates into Finance, Engineering, and Compliance; Corporate contains Legal\. At depth33, Finance contains Market Data, Treasury, and Controls; Engineering contains Build Security and Production Security; Compliance contains Audit; and Legal contains eDiscovery\. The resources below are leaves at depth44\.

All non\-leaf nodes have local labelL0L\_\{0\}\. Therefore, for every resource leafrrin Table[3](https://arxiv.org/html/2607.09744#S7.T3),

J​\(r\)=ℓ​\(r\)\.J\(r\)=\\ell\(r\)\.The table uses only labels defined by the sensitivity lattice\.

Table 3:Resource leaves, local labels, and accumulated labels\.The hierarchy gives four relevant structural factors:

ultraControls\\displaystyle\\operatorname\{ultra\}\_\{\\mathrm\{Controls\}\}=2−\(2⋅3\+1\)=1128,\\displaystyle=2^\{\-\(2\\cdot 3\+1\)\}=\\frac\{1\}\{128\},ultraFinance\\displaystyle\\operatorname\{ultra\}\_\{\\mathrm\{Finance\}\}=2−\(2⋅2\+1\)=132,\\displaystyle=2^\{\-\(2\\cdot 2\+1\)\}=\\frac\{1\}\{32\},ultraFin​\-​Eng\\displaystyle\\operatorname\{ultra\}\_\{\\mathrm\{Fin\\text\{\-\}Eng\}\}=2−\(2⋅1\+1\)=18,\\displaystyle=2^\{\-\(2\\cdot 1\+1\)\}=\\frac\{1\}\{8\},ultraOps​\-​Corp\\displaystyle\\operatorname\{ultra\}\_\{\\mathrm\{Ops\\text\{\-\}Corp\}\}=2−\(2⋅0\+1\)=12\.\\displaystyle=2^\{\-\(2\\cdot 0\+1\)\}=\\frac\{1\}\{2\}\.The following reference radii are those used by the maximizing pairs below\. Each such pair contains at least oneL5​CL\_\{5C\}orL5​IL\_\{5I\}endpoint, so its pair multiplier is1\.751\.75\. Other action pairs in the same structural band may have smaller radii when their endpoint labels are lower\.

rControls\\displaystyle r\_\{\\mathrm\{Controls\}\}=1\.75⋅1128=0\.013671875,\\displaystyle=75\\cdot\\frac\{1\}\{128\}=013671875,rFinance\\displaystyle r\_\{\\mathrm\{Finance\}\}=1\.75⋅132=0\.0546875,\\displaystyle=75\\cdot\\frac\{1\}\{32\}=0546875,rFin​\-​Eng\\displaystyle r\_\{\\mathrm\{Fin\\text\{\-\}Eng\}\}=1\.75⋅18=0\.21875,\\displaystyle=75\\cdot\\frac\{1\}\{8\}=21875,rOps​\-​Corp\\displaystyle r\_\{\\mathrm\{Ops\\text\{\-\}Corp\}\}=1\.75⋅12=0\.875\.\\displaystyle=75\\cdot\\frac\{1\}\{2\}=875\.
The example adopts

θ=0\.21875,τaut=0\.50000\.\\theta=0\.21875,\\qquad\\tau\_\{\\mathrm\{aut\}\}=0\.50000\.The threshold is an externally selected policy boundary calibrated to the Finance–Engineering radius\. The larger Operations–Corporate radius0\.8750\.875remains catalogue calibration data and does not automatically changeθ\\theta\.

### 7\.2Agents, Actions, and Directed Meetings

Table[4](https://arxiv.org/html/2607.09744#S7.T4)specifies action control\-flow type and operation explicitly\. A queue writer may be a GateKeeper action and its consumer may be an Accessor read action; both actions remain members of the ordinary write and read sets used by the influence\-potential definition\.

For brevity, the resource\-provider and sensitivity fields of each action are suppressed in the table; they are fixed by the policy catalogue for the listed resource node\. The calculations below use the associated node, control\-flow classification, and operation\.

Table 4:Agent actions\. The notation\(G​K,W\)\(GK,W\)denotes a GateKeeper write and\(A​c,R\)\(Ac,R\)an Accessor read\.The nonempty directed meeting\-witness sets are:

Ordered pairShared write–read node\(Uθs,Uθt\)Qθ\(Uθ​τs,Uθ​τt\)Qθ​τ\(Uauths,Uautht\)Qauth\(Ureq,Udec\)Qreview\(Udec,Ureq\)Qdecision\\begin\{array\}\[\]\{c\|c\}\\text\{Ordered pair\}&\\text\{Shared write\-\-read node\}\\\\ \\hline\\cr\(U\_\{\\theta\}^\{s\},U\_\{\\theta\}^\{t\}\)&Q\_\{\\theta\}\\\\ \(U\_\{\\theta\\tau\}^\{s\},U\_\{\\theta\\tau\}^\{t\}\)&Q\_\{\\theta\\tau\}\\\\ \(U\_\{\\mathrm\{auth\}\}^\{s\},U\_\{\\mathrm\{auth\}\}^\{t\}\)&Q\_\{\\mathrm\{auth\}\}\\\\ \(U\_\{\\mathrm\{req\}\},U\_\{\\mathrm\{dec\}\}\)&Q\_\{\\mathrm\{review\}\}\\\\ \(U\_\{\\mathrm\{dec\}\},U\_\{\\mathrm\{req\}\}\)&Q\_\{\\mathrm\{decision\}\}\\end\{array\}No other ordered pair has a shared write–read node\. In particular,UτU\_\{\\tau\}has no directed meeting with any other agent\.

### 7\.3Influence Potentials and Graph Construction

For the local reverse meeting,

Φ​\(Udec→Ureq\)\\displaystyle\\Phi\(U\_\{\\mathrm\{dec\}\}\\to U\_\{\\mathrm\{req\}\}\)=d𝒜​\(Qdecision,Requested Release\)\\displaystyle=d\_\{\\mathcal\{A\}\}\\bigl\(Q\_\{\\mathrm\{decision\}\},\\text\{Requested Release\}\\bigr\)=1\.75⋅1128\\displaystyle=75\\cdot\\frac\{1\}\{128\}=0\.013671875<θ\.\\displaystyle=013671875<\\theta\.This meeting is genuine but does not produce an influence arc\.

The remaining meeting\-conditioned potentials are:

Φ​\(Uθs→Uθt\)\\displaystyle\\Phi\(U\_\{\\theta\}^\{s\}\\to U\_\{\\theta\}^\{t\}\)=d𝒜​\(Rate Feed,Signing Key\)=0\.21875,\\displaystyle=d\_\{\\mathcal\{A\}\}\\bigl\(\\text\{Rate Feed\},\\text\{Signing Key\}\\bigr\)=21875,Φ​\(Uθ​τs→Uθ​τt\)\\displaystyle\\Phi\(U\_\{\\theta\\tau\}^\{s\}\\to U\_\{\\theta\\tau\}^\{t\}\)=d𝒜​\(Corporate Audit Package,Build Attestation\)=0\.875,\\displaystyle=d\_\{\\mathcal\{A\}\}\\bigl\(\\text\{Corporate Audit Package\},\\text\{Build Attestation\}\\bigr\)=875,Φ​\(Uauths→Uautht\)\\displaystyle\\Phi\(U\_\{\\mathrm\{auth\}\}^\{s\}\\to U\_\{\\mathrm\{auth\}\}^\{t\}\)=d𝒜​\(Wire Transfers,Release Manifest\)=0\.21875,\\displaystyle=d\_\{\\mathcal\{A\}\}\\bigl\(\\text\{Wire Transfers\},\\text\{Release Manifest\}\\bigr\)=21875,Φ​\(Ureq→Udec\)\\displaystyle\\Phi\(U\_\{\\mathrm\{req\}\}\\to U\_\{\\mathrm\{dec\}\}\)=d𝒜​\(Market\-Risk Report,Deployment Policy\)=0\.21875\.\\displaystyle=d\_\{\\mathcal\{A\}\}\\bigl\(\\text\{Market\-Risk Report\},\\text\{Deployment Policy\}\\bigr\)=21875\.The shared queue is the directed meeting witness in each case; the displayed remote action pair attains the maximum and measures operational span\. It is not asserted to be a direct data\-flow channel\.

Therefore,

Eθ=\{\(Uθs,Uθt\),\(Uθ​τs,Uθ​τt\),\(Uauths,Uautht\),\(Ureq,Udec\)\}\.E\_\{\\theta\}=\\left\\\{\(U\_\{\\theta\}^\{s\},U\_\{\\theta\}^\{t\}\),\(U\_\{\\theta\\tau\}^\{s\},U\_\{\\theta\\tau\}^\{t\}\),\(U\_\{\\mathrm\{auth\}\}^\{s\},U\_\{\\mathrm\{auth\}\}^\{t\}\),\(U\_\{\\mathrm\{req\}\},U\_\{\\mathrm\{dec\}\}\)\\right\\\}\.Every listed arc is admitted through a directed resource meeting and satisfiesΦ​\(U→V\)≥θ\\Phi\(U\\to V\)\\geq\\theta\.

### 7\.4Individual Blast Radius, Authorization, and Collusion

For concise reporting, define the direct and effective maximum radii by

βdir​\(U\):=\{max⁡\{d𝒜​\(a,b\):a,b∈𝒜​\(U\),a≠b\},\|𝒜​\(U\)\|≥2,0,\|𝒜​\(U\)\|<2,\\beta\_\{\\mathrm\{dir\}\}\(U\):=\\begin\{cases\}\\displaystyle\\max\\left\\\{d\_\{\\mathcal\{A\}\}\(a,b\):a,b\\in\\mathcal\{A\}\(U\),\\ a\\neq b\\right\\\},&\|\\mathcal\{A\}\(U\)\|\\geq 2,\\\\\[6\.0pt\] 0,&\|\\mathcal\{A\}\(U\)\|<2,\\end\{cases\}and

βH​\(U\):=\{max⁡\{d𝒜​\(a,b\):a,b∈ℰH​\(U\),a≠b\},\|ℰH​\(U\)\|≥2,0,\|ℰH​\(U\)\|<2\.\\beta\_\{H\}\(U\):=\\begin\{cases\}\\displaystyle\\max\\left\\\{d\_\{\\mathcal\{A\}\}\(a,b\):a,b\\in\\mathcal\{E\}\_\{H\}\(U\),\\ a\\neq b\\right\\\},&\|\\mathcal\{E\}\_\{H\}\(U\)\|\\geq 2,\\\\\[6\.0pt\] 0,&\|\\mathcal\{E\}\_\{H\}\(U\)\|<2\.\\end\{cases\}These are reporting shorthands for the individual blast\-radius bound in Section[6](https://arxiv.org/html/2607.09744#S6); they introduce no new action or scope types\.

All influence arcs are authorized in this baseline:

𝖠𝗅𝗅𝗈𝗐=Eθ\.\\mathsf\{Allow\}=E\_\{\\theta\}\.This choice isolates the individual\-radius and collusion conditions; the example does not include an unauthorized\-influence case\.

The following calculations distinguish the six cases:

Agentβdir​\(U\)βH​\(U\)Uτ0\.8750\.875Uθs0\.05468750\.21875Uθt0\.218750\.21875Uθ​τs0\.8750\.875Uθ​τt0\.218750\.21875Uauths0\.05468750\.21875Uautht0\.218750\.21875Ureq0\.05468750\.21875Udec0\.218750\.21875U000\\begin\{array\}\[\]\{c\|c\|c\}\\text\{Agent\}&\\beta\_\{\\mathrm\{dir\}\}\(U\)&\\beta\_\{H\}\(U\)\\\\ \\hline\\cr U\_\{\\tau\}&0\.875&0\.875\\\\ U\_\{\\theta\}^\{s\}&0\.0546875&0\.21875\\\\ U\_\{\\theta\}^\{t\}&0\.21875&0\.21875\\\\ U\_\{\\theta\\tau\}^\{s\}&0\.875&0\.875\\\\ U\_\{\\theta\\tau\}^\{t\}&0\.21875&0\.21875\\\\ U\_\{\\mathrm\{auth\}\}^\{s\}&0\.0546875&0\.21875\\\\ U\_\{\\mathrm\{auth\}\}^\{t\}&0\.21875&0\.21875\\\\ U\_\{\\mathrm\{req\}\}&0\.0546875&0\.21875\\\\ U\_\{\\mathrm\{dec\}\}&0\.21875&0\.21875\\\\ U\_\{0\}&0&0\\end\{array\}Thus, every agent exceptUτU\_\{\\tau\}andUθ​τsU\_\{\\theta\\tau\}^\{s\}has individual direct radius below0\.250\.25, and every agent in the threshold\-only, authorization\-composition, and decision\-manipulation components has effective radius0\.21875<τaut0\.21875<\\tau\_\{\\mathrm\{aut\}\}\.

For collusion analysis, specify exactly two gate relations:

Qauth↝gateRelease Manifest,Qdecision↝gateRequested Release\.Q\_\{\\mathrm\{auth\}\}\\rightsquigarrow\_\{\\mathrm\{gate\}\}\\text\{Release Manifest\},\\qquad Q\_\{\\mathrm\{decision\}\}\\rightsquigarrow\_\{\\mathrm\{gate\}\}\\text\{Requested Release\}\.All other gate\-relation pairs are absent\. Hence,

Gates​\(Uauths,Uautht\)\\displaystyle\\mathrm\{Gates\}\(U\_\{\\mathrm\{auth\}\}^\{s\},U\_\{\\mathrm\{auth\}\}^\{t\}\)=true,\\displaystyle=\\mathrm\{true\},Gates​\(Udec,Ureq\)\\displaystyle\\mathrm\{Gates\}\(U\_\{\\mathrm\{dec\}\},U\_\{\\mathrm\{req\}\}\)=true\.\\displaystyle=\\mathrm\{true\}\.Set

⟂pol=∅\\perp\_\{\\mathrm\{pol\}\}=\\varnothingto isolate the authorization and decision clauses of the collusion predicate\.

The following are local agent\-level or component\-level diagnostic outcomes\. They do not imply that the baseline configuration as a whole satisfies least autonomy\.

1. 1\.Individual\-budget breach only\. βH​\(Uτ\)=0\.875\>τaut\.\\beta\_\{H\}\(U\_\{\\tau\}\)=0\.875\>\\tau\_\{\\mathrm\{aut\}\}\.AgentUτU\_\{\\tau\}has no directed meeting, no influence arc, and no collusion witness\.
2. 2\.Material influence only\.The pair \(Uθs,Uθt\)\(U\_\{\\theta\}^\{s\},U\_\{\\theta\}^\{t\}\)has Φ​\(Uθs→Uθt\)=θ=0\.21875,\\Phi\(U\_\{\\theta\}^\{s\}\\to U\_\{\\theta\}^\{t\}\)=\\theta=0\.21875,while both agents satisfy the individual budget and have no collusion witness\.
3. 3\.Both material influence and individual\-budget breach\. Φ​\(Uθ​τs→Uθ​τt\)=0\.875≥θ,βH​\(Uθ​τs\)=0\.875\>τaut\.\\Phi\(U\_\{\\theta\\tau\}^\{s\}\\to U\_\{\\theta\\tau\}^\{t\}\)=0\.875\\geq\\theta,\\qquad\\beta\_\{H\}\(U\_\{\\theta\\tau\}^\{s\}\)=0\.875\>\\tau\_\{\\mathrm\{aut\}\}\.No gate relation is defined for this component\.
4. 4\.Authorization\-composition collusion\. Gates​\(Uauths,Uautht\)andUauths↝HUautht\.\\mathrm\{Gates\}\(U\_\{\\mathrm\{auth\}\}^\{s\},U\_\{\\mathrm\{auth\}\}^\{t\}\)\\quad\\text\{and\}\\quad U\_\{\\mathrm\{auth\}\}^\{s\}\\leadsto\_\{H\}U\_\{\\mathrm\{auth\}\}^\{t\}\.Therefore, ColludeH​\(\{Uauths,Uautht\}\)=true\.\\mathrm\{Collude\}\_\{H\}\\bigl\(\\\{U\_\{\\mathrm\{auth\}\}^\{s\},U\_\{\\mathrm\{auth\}\}^\{t\}\\\}\\bigr\)=\\mathrm\{true\}\.Both agents remainτaut\\tau\_\{\\mathrm\{aut\}\}\-compliant\.
5. 5\.Decision\-manipulation collusion\. Gates​\(Udec,Ureq\)andUreq↝HUdec\.\\mathrm\{Gates\}\(U\_\{\\mathrm\{dec\}\},U\_\{\\mathrm\{req\}\}\)\\quad\\text\{and\}\\quad U\_\{\\mathrm\{req\}\}\\leadsto\_\{H\}U\_\{\\mathrm\{dec\}\}\.Therefore, ColludeH​\(\{Ureq,Udec\}\)=true\.\\mathrm\{Collude\}\_\{H\}\\bigl\(\\\{U\_\{\\mathrm\{req\}\},U\_\{\\mathrm\{dec\}\}\\\}\\bigr\)=\\mathrm\{true\}\.The gate direction is opposite to the influence direction, as required by clause \(ii\) of the collusion predicate\. Both agents remainτaut\\tau\_\{\\mathrm\{aut\}\}\-compliant\.
6. 6\.Locally clean case\.AgentU0U\_\{0\}has one standard Accessor action, no meeting witness, no incident influence arc, no gate relation, and βH​\(U0\)=0\.\\beta\_\{H\}\(U\_\{0\}\)=0\.It satisfies the individual blast\-radius bound and has no incident influence arc or local collusion witness\. The baseline configuration as a whole still fails least autonomy because other components are collusion\-positive\.

Theθ\\thetathreshold is an edge\-admission policy, not a standalone per\-agent budget\. Consequently, the two collusion cases must be incident toθ\\theta\-qualified arcs in order to appear inHHand be evaluated by the current collusion predicate\. Their intended interpretation is*individually narrow andτaut\\tau\_\{\\mathrm\{aut\}\}\-compliant, but collusion\-positive*\.

## 8Limitations and Future Work

#### Directed and semantic influence\.

The operational graph records model\-level potential influence, not a provenance\-preserving account of dataflow\. A directed path can be witnessed by different write\-to\-read action pairs on its successive arcs\.

#### Static workflows and action sequencing\.

The model does not represent time, workflow state, conditional approvals, revocation delays, or the semantics of long action sequences\. Consequently, it may over\- or under\-approximate risk in systems where these features materially affect whether an influence path can be exercised\.

#### Operation\-sensitive risk\.

The current blast\-radius metric measures structural separation between resource nodes and does not directly distinguish operation types or control\-flow classifications\. Consequently, a read action and a destructive write or delete action associated with the same node have zero structural distance\. Such actions may still be significant under direct\-permission, gate, or collusion checks, but the model does not currently assign them different local blast radii\. Extending the framework with an operation\-severity taxonomy is left to future work\.

#### Policy\-model specification\.

The operational analysis depends on an accurately specified resource hierarchy, action catalogue, label assignment, gate relation, domain separation relation, and authorization relation\. Provider\-level classification may be a useful practical approximation, but it can obscure resource\-level variation\. Methods for eliciting, validating, and maintaining these policy inputs are outside the present scope\.

#### Availability and safety\.

The current label structure addresses confidentiality and integrity only\. Availability, physical safety, financial loss, and other risk dimensions would require additional labels, policy relations, and validation criteria\.

#### Coalition\-level quantitative bounds\.

The framework identifies collusion witnesses but does not provide quantitative bounds on coalition effective autonomy in terms of individual blast radii\. Establishing such bounds, if possible under suitable structural assumptions, remains future work\.

#### Direct agent\-to\-agent communication\.

The model represents direct A2A communication through a binary undirected meeting relation\. This is intentionally conservative: a configured communication path is treated as permitting reciprocal influence, even when the operational workflow appears one\-way\. The model does not yet distinguish channel authentication strength, message provenance, protocol semantics, content filtering, session state, or runtime enforcement\.

## 9Conclusion

Least privilege remains necessary for agentic AI systems, but it does not by itself characterize the authority exposure that can arise when permissions are distributed across interacting agents\. This paper introduced least autonomy as a complementary design criterion for that setting\.

The theory has three layers\. First, the compositional blast radiusd​\(a,b\)d\(a,b\)provides a pseudoultrametric over actions that combines enterprise hierarchy with accumulated sensitivity\. Second, the meeting\-conditioned influence potentialΦ​\(U→V\)\\Phi\(U\\to V\)and influence graphG​\(θ\)G\(\\theta\)identify high\-impact resource\-mediated and A2A\-mediated interactions\. Third, effective autonomy and the collusion predicate screen for authorization composition, decision manipulation, and cross\-domain capability composition under a conservative threat model\.

The framework is deliberately a static policy\-analysis abstraction\. A positive influence or collusion result identifies an auditable configuration that warrants review; it does not by itself establish provenance, command authority, malicious intent, or a realized end\-to\-end execution trace\. Likewise, the framework requires policy inputs beyond provider classification, including the resource hierarchy, action catalogue, thresholds, authorization and gate relations, and separation policy\.

The intended use is therefore to complement existing access\-control and agent\-runtime safeguards: it helps security engineers identify where otherwise individually plausible permissions create excessive autonomous reach or capability\-composition risk\. Future work should evaluate the calibration ofθ\\thetaandτaut\\tau\_\{\\mathrm\{aut\}\}, the precision of the screening results, and the integration of workflow and runtime evidence\.

## References

- \[1\]M\. A\. Harrison, W\. L\. Ruzzo, and J\. D\. Ullman\.Protection in operating systems\.*Communications of the ACM*, 19\(8\):461–471, 1976\.
- \[2\]R\. S\. Sandhu\.Role\-based access control\.*Advances in computers*, 1998, Elsevier\.
- \[3\]D\. R\. Kuhn\.Mutual exclusion of roles as a means of implementing separation of duty in role\-based access control systems\.In*Proceedings of the Second ACM Workshop on Role\-Based Access Control*, pages 23–30, 1997\.
- \[4\]E\. Bertino, E\. Ferrari, and V\. Atluri\.The specification and enforcement of authorization constraints in workflow management systems\.*ACM Transactions on Information and System Security*, 2\(1\):65–104, 1999\.
- \[5\]K\. Fisler, S\. Krishnamurthi, L\. A\. Meyerovich, and M\. C\. Tschantz\.Verification and change\-impact analysis of access\-control policies\.In*Proceedings of the 27th International Conference on Software Engineering*, pages 196–205, 2005\.
- \[6\]P\. Ammann, D\. Wijesekera, and S\. Kaushik\.Scalable, graph\-based network vulnerability analysis\.In*Proceedings of the 9th ACM Conference on Computer and Communications Security*, pages 217–224, 2002\.
- \[7\]O\. Sheyner, J\. Haines, S\. Jha, R\. Lippmann, and J\. M\. Wing\.Automated generation and analysis of attack graphs\.In*Proceedings of the 2002 IEEE Symposium on Security and Privacy*, pages 273–284, 2002\.
- \[8\]E\. Debenedetti, J\. Zhang, M\. Balunović, L\. Beurer\-Kellner, M\. Fischer, and F\. Tramèr\.AgentDojo: A dynamic environment to evaluate prompt injection attacks and defenses for LLM agents\.In*Advances in Neural Information Processing Systems 37, Datasets and Benchmarks Track*, pages 82895–82920, 2024\.
- \[9\]J\. Kim, W\. Choi, and B\. Lee\.Prompt flow integrity to prevent privilege escalation in LLM agents\.arXiv preprint arXiv:2503\.15547, 2025\.
- \[10\]T\. Shi, J\. He, Z\. Wang, H\. Li, L\. Wu, W\. Guo, and D\. Song\.Progent: Programmable privilege control for LLM agents\.arXiv preprint arXiv:2504\.11703, 2025\.
- \[11\]J\. Zhu, K\. Tseng, G\. Vernik, X\. Huang, S\. G\. Patil, V\. Fang, and R\. A\. Popa\.MiniScope: A least privilege framework for authorizing tool calling agents\.arXiv preprint arXiv:2512\.11147, 2025\.
- \[12\]J\. H\. Saltzer and M\. D\. Schroeder\.The protection of information in computer systems\.*Proceedings of the IEEE*, 63\(9\):1278–1308, 1975\.
- \[13\]D\. E\. Denning\.A lattice model of secure information flow\.*Communications of the ACM*, 19\(5\):236–243, 1976\.
- \[14\]A\. Sabelfeld and A\. C\. Myers\.Language\-based information\-flow security\.*IEEE Journal on Selected Areas in Communications*, 21\(1\):5–19, 2003\.
- \[15\]Y\. Ruan, H\. Dong, A\. Wang, S\. Pitis, Y\. Zhou, J\. Ba, Y\. Dubois, C\. J\. Maddison, and T\. Hashimoto\.Identifying the risks of LM agents with an LM\-emulated sandbox\.In*International Conference on Learning Representations*, 2024\.

## Appendix AThe Compositional Blast Radius Is Pseudoultrametric

LetNNdenote the node set of the rooted enterprise tree\. Forx,y∈Nx,y\\in N, define the underlying hierarchical distance

u​\(x,y\):=\{0,x=y,2−\(2​D​\(lca⁡\(x,y\)\)\+1\),x≠y\.u\(x,y\):=\\begin\{cases\}0,&x=y,\\\\\[2\.0pt\] 2^\{\-\\left\(2D\\\!\\bigl\(\\operatorname\{lca\}\(x,y\)\\bigr\)\+1\\right\)\},&x\\neq y\.\\end\{cases\}
LetJ:N→ℒJ:N\\to\\mathcal\{L\}assign a path\-accumulated security label to each node, and let

F:ℒ→\(0,∞\)F:\\mathcal\{L\}\\to\(0,\\infty\)be the corresponding multiplier function\. Assume thatℒ\\mathcal\{L\}is finite, and define

Fmin:=minℓ∈ℒ⁡F​\(ℓ\),Fmax:=maxℓ∈ℒ⁡F​\(ℓ\)\.F\_\{\\min\}:=\\min\_\{\\ell\\in\\mathcal\{L\}\}F\(\\ell\),\\qquad F\_\{\\max\}:=\\max\_\{\\ell\\in\\mathcal\{L\}\}F\(\\ell\)\.Assume that

FmaxFmin<4\.\\frac\{F\_\{\\max\}\}\{F\_\{\\min\}\}<4\.
For each nodex∈Nx\\in N, write

m​\(x\):=F​\(J​\(x\)\)\.m\(x\):=F\(J\(x\)\)\.Define the node\-level compositional blast radius by

dN​\(x,y\):=max⁡\{m​\(x\),m​\(y\)\}​u​\(x,y\),x,y∈N\.d\_\{N\}\(x,y\):=\\max\\\!\\left\\\{m\(x\),m\(y\)\\right\\\}u\(x,y\),\\qquad x,y\\in N\.
###### Proposition A\.1\.

The functiondNd\_\{N\}is an ultrametric onNN\.

###### Proof\.

The functiondNd\_\{N\}is symmetric because both

max⁡\{m​\(x\),m​\(y\)\}\\max\\\!\\left\\\{m\(x\),m\(y\)\\right\\\}andu​\(x,y\)u\(x,y\)are symmetric inxxandyy\. Moreover,

for everyx∈Nx\\in N, sinceu​\(x,x\)=0u\(x,x\)=0\. Ifx≠yx\\neq y, thenu​\(x,y\)\>0u\(x,y\)\>0and

max⁡\{m​\(x\),m​\(y\)\}\>0,\\max\\\!\\left\\\{m\(x\),m\(y\)\\right\\\}\>0,sodN​\(x,y\)\>0d\_\{N\}\(x,y\)\>0\.

It remains to prove the strong triangle inequality\. Letx,y,z∈Nx,y,z\\in N\. If two of the nodes coincide, the claim follows immediately from symmetry anddN​\(w,w\)=0d\_\{N\}\(w,w\)=0for everyw∈Nw\\in N\. Hence suppose thatxx,yy, andzzare distinct\.

For three distinct nodes in a rooted tree, either all three pairwise least common ancestors coincide, or exactly two pairwise least common ancestors coincide and lie strictly above the third\.

First suppose that

lca⁡\(x,y\)=lca⁡\(x,z\)=lca⁡\(y,z\)=p\.\\operatorname\{lca\}\(x,y\)=\\operatorname\{lca\}\(x,z\)=\\operatorname\{lca\}\(y,z\)=p\.Then define

U:=2−\(2​D​\(p\)\+1\)U:=2^\{\-\\left\(2D\(p\)\+1\\right\)\}Since all three pairs have least common ancestorpp,

u​\(x,y\)=u​\(x,z\)=u​\(y,z\)=U\.u\(x,y\)=u\(x,z\)=u\(y,z\)=U\.Let

M:=max⁡\{m​\(x\),m​\(y\),m​\(z\)\}\.M:=\\max\\\!\\left\\\{m\(x\),m\(y\),m\(z\)\\right\\\}\.We have

dN​\(x,y\)=max⁡\{m​\(x\),m​\(y\)\}⋅U≤M⋅U\.d\_\{N\}\(x,y\)=\\max\\\!\\left\\\{m\(x\),m\(y\)\\right\\\}\\cdot U\\leq M\\cdot U\.On the other hand,

max⁡\{dN​\(x,z\),dN​\(y,z\)\}\\displaystyle\\max\\\!\\left\\\{d\_\{N\}\(x,z\),d\_\{N\}\(y,z\)\\right\\\}=max⁡\{max⁡\{m​\(x\),m​\(z\)\}⋅U,max⁡\{m​\(y\),m​\(z\)\}⋅U\}\\displaystyle=\\max\\\!\\left\\\{\\max\\\!\\left\\\{m\(x\),m\(z\)\\right\\\}\\cdot U,\\max\\\!\\left\\\{m\(y\),m\(z\)\\right\\\}\\cdot U\\right\\\}=M⋅U\.\\displaystyle=M\\cdot U\.Therefore,

dN​\(x,y\)≤max⁡\{dN​\(x,z\),dN​\(y,z\)\}\.d\_\{N\}\(x,y\)\\leq\\max\\\!\\left\\\{d\_\{N\}\(x,z\),d\_\{N\}\(y,z\)\\right\\\}\.
Otherwise, after relabelling the nodes if necessary, there existp,q∈Np,q\\in Nsuch that

lca⁡\(x,z\)=lca⁡\(y,z\)=p,lca⁡\(x,y\)=q,\\operatorname\{lca\}\(x,z\)=\\operatorname\{lca\}\(y,z\)=p,\\qquad\\operatorname\{lca\}\(x,y\)=q,whereqqis a strict descendant ofpp\. Let

U:=u​\(x,z\)=u​\(y,z\)=2−\(2​D​\(p\)\+1\)\.U:=u\(x,z\)=u\(y,z\)=2^\{\-\\left\(2D\(p\)\+1\\right\)\}\.Sinceqqis a strict descendant ofpp,

D​\(q\)≥D​\(p\)\+1,D\(q\)\\geq D\(p\)\+1,and hence

u​\(x,y\)=2−\(2​D​\(q\)\+1\)≤U4\.u\(x,y\)=2^\{\-\\left\(2D\(q\)\+1\\right\)\}\\leq\\frac\{U\}\{4\}\.
Let

M:=max⁡\{m​\(x\),m​\(y\),m​\(z\)\}\.M:=\\max\\\!\\left\\\{m\(x\),m\(y\),m\(z\)\\right\\\}\.For the two longer pairs,

max⁡\{dN​\(x,z\),dN​\(y,z\)\}\\displaystyle\\max\\\!\\left\\\{d\_\{N\}\(x,z\),d\_\{N\}\(y,z\)\\right\\\}=max⁡\{max⁡\{m​\(x\),m​\(z\)\}⋅U,max⁡\{m​\(y\),m​\(z\)\}⋅U\}\\displaystyle=\\max\\\!\\left\\\{\\max\\\!\\left\\\{m\(x\),m\(z\)\\right\\\}\\cdot U,\\max\\\!\\left\\\{m\(y\),m\(z\)\\right\\\}\\cdot U\\right\\\}=M⋅U\.\\displaystyle=M\\cdot U\.For the remaining pair,

dN​\(x,y\)\\displaystyle d\_\{N\}\(x,y\)=max⁡\{m​\(x\),m​\(y\)\}⋅u​\(x,y\)\\displaystyle=\\max\\\!\\left\\\{m\(x\),m\(y\)\\right\\\}\\cdot u\(x,y\)≤Fmax​U4\\displaystyle\\leq F\_\{\\max\}\\frac\{U\}\{4\}<Fmin​U\\displaystyle<F\_\{\\min\}U≤M​U\\displaystyle\\leq MU=max⁡\{dN​\(x,z\),dN​\(y,z\)\}\.\\displaystyle=\\max\\\!\\left\\\{d\_\{N\}\(x,z\),d\_\{N\}\(y,z\)\\right\\\}\.Thus,

dN​\(x,y\)≤max⁡\{dN​\(x,z\),dN​\(y,z\)\}\.d\_\{N\}\(x,y\)\\leq\\max\\\!\\left\\\{d\_\{N\}\(x,z\),d\_\{N\}\(y,z\)\\right\\\}\.
The other orderings follow by relabellingxx,yy, andzz\. ThereforedNd\_\{N\}satisfies the strong triangle inequality and is an ultrametric onNN\. ∎

Let

node:𝒜→N\\operatorname\{node\}:\\mathcal\{A\}\\to Nmap every action to its associated resource node\. For actionsa,b∈𝒜a,b\\in\\mathcal\{A\}, define

d𝒜​\(a,b\):=dN​\(node⁡\(a\),node⁡\(b\)\)\.d\_\{\\mathcal\{A\}\}\(a,b\):=d\_\{N\}\\\!\\bigl\(\\operatorname\{node\}\(a\),\\operatorname\{node\}\(b\)\\bigr\)\.Equivalently, if

ua:=node⁡\(a\),ub:=node⁡\(b\),u\_\{a\}:=\\operatorname\{node\}\(a\),\\qquad u\_\{b\}:=\\operatorname\{node\}\(b\),then

d𝒜​\(a,b\)=max⁡\{F​\(J​\(ua\)\),F​\(J​\(ub\)\)\}​ultra⁡\(ua,ub\)\.d\_\{\\mathcal\{A\}\}\(a,b\)=\\max\\\!\\left\\\{F\(J\(u\_\{a\}\)\),F\(J\(u\_\{b\}\)\)\\right\\\}\\operatorname\{ultra\}\(u\_\{a\},u\_\{b\}\)\.
###### Corollary A\.2\.

The functiond𝒜d\_\{\\mathcal\{A\}\}is a pseudoultrametric on𝒜\\mathcal\{A\}\.

###### Proof\.

Symmetry and the strong triangle inequality follow directly from Proposition[A\.1](https://arxiv.org/html/2607.09744#A1.Thmtheorem1)\. Further,

d𝒜​\(a,a\)=0d\_\{\\mathcal\{A\}\}\(a,a\)=0for everya∈𝒜a\\in\\mathcal\{A\}\. However, distinct actionsa≠ba\\neq bmay be associated with the same resource node, in which case

node⁡\(a\)=node⁡\(b\)\\operatorname\{node\}\(a\)=\\operatorname\{node\}\(b\)and therefore

d𝒜​\(a,b\)=0\.d\_\{\\mathcal\{A\}\}\(a,b\)=0\.Thusd𝒜d\_\{\\mathcal\{A\}\}need not separate distinct actions and is, in general, a pseudoultrametric rather than an ultrametric\. ∎

## Appendix BPseudocode for influence graph and least\-autonomy evaluation

1:Tree

𝒯\\mathcal\{T\}; agents

𝒰\\mathcal\{U\}; action sets; undirected A2A communication relation

𝒞A2A\\mathcal\{C\}\_\{\\mathrm\{A2A\}\};

\{𝒜​\(U\)\}U∈𝒰\\\{\\mathcal\{A\}\(U\)\\\}\_\{U\\in\\mathcal\{U\}\}; policy thresholds

θ\\thetaand

τaut\\tau\_\{\\mathrm\{aut\}\}; gate relation

↝gate\\rightsquigarrow\_\{\\mathrm\{gate\}\}; sensitivity domains

\{𝒟i\}\\\{\\mathcal\{D\}\_\{i\}\\\}; separation relation

⟂pol\\perp\_\{\\mathrm\{pol\}\}; authorization relation

𝖠𝗅𝗅𝗈𝗐\\mathsf\{Allow\}
2:Influence graph

G​\(θ\)G\(\\theta\); weak components of

G¯​\(θ\)\\overline\{G\}\(\\theta\); influence potentials

Φ\\Phi; effective\-autonomy sets

\{ℰH​\(U\)\}\\\{\\mathcal\{E\}\_\{H\}\(U\)\\\}; effective blast radii

\{βH​\(U\)\}\\\{\\beta\_\{H\}\(U\)\\\}; meeting witnesses; collusion witnesses; a policy\-violation report; and

LeastAutonomy\\mathrm\{LeastAutonomy\}
3:Phase 1: Precomputation

4:Compute

J​\(v\)J\(v\)and

D​\(v\)D\(v\)for all

v∈Nv\\in N
5:Preprocess

𝒯\\mathcal\{T\}for LCA queries

6:foreach

U∈𝒰U\\in\\mathcal\{U\}do

7:Compute

𝒲​\(U\)\\mathcal\{W\}\(U\),

ℛ​\(U\)\\mathcal\{R\}\(U\),

𝒢​\(U\)\\mathcal\{G\}\(U\), and

𝒳​\(U\)\\mathcal\{X\}\(U\)
8:endfor

9:Define

Gates​\(U,V\)\\mathrm\{Gates\}\(U,V\)from

↝gate\\rightsquigarrow\_\{\\mathrm\{gate\}\},

𝒢​\(U\)\\mathcal\{G\}\(U\), and

𝒳​\(V\)\\mathcal\{X\}\(V\)
10:Phase 2: Directed meetings, influence potentials, and graph

11:Initialize

Eθ←∅E\_\{\\theta\}\\leftarrow\\varnothing
12:Initialize

𝖬𝖾𝖾𝗍𝗂𝗇𝗀𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌←∅\\mathsf\{MeetingWitnesses\}\\leftarrow\\varnothing
13:Initialize

Φ​\(U→V\)←0\\Phi\(U\\to V\)\\leftarrow 0for all

U,V∈𝒰U,V\\in\\mathcal\{U\}with

U≠VU\\neq V
14:foreach ordered pair

\(U,V\)∈𝒰×𝒰\(U,V\)\\in\\mathcal\{U\}\\times\\mathcal\{U\}with

U≠VU\\neq Vdo

15:

ℳ​\(U,V\)←\{\(a,b\)∈𝒲​\(U\)×ℛ​\(V\):node⁡\(a\)=node⁡\(b\)\}\\mathcal\{M\}\(U,V\)\\leftarrow\\\{\(a,b\)\\in\\mathcal\{W\}\(U\)\\times\\mathcal\{R\}\(V\):\\operatorname\{node\}\(a\)=\\operatorname\{node\}\(b\)\\\}
16:

RMeet​\(U,V\)←\(ℳ​\(U,V\)≠∅\)\\mathrm\{RMeet\}\(U,V\)\\leftarrow\\bigl\(\\mathcal\{M\}\(U,V\)\\neq\\varnothing\\bigr\)
17:

A2AMeet​\(U,V\)←\(\{U,V\}∈𝒞A2A\)\\mathrm\{A2AMeet\}\(U,V\)\\leftarrow\\bigl\(\\\{U,V\\\}\\in\\mathcal\{C\}\_\{\\mathrm\{A2A\}\}\\bigr\)
18:

Meet​\(U,V\)←RMeet​\(U,V\)∨A2AMeet​\(U,V\)\\mathrm\{Meet\}\(U,V\)\\leftarrow\\mathrm\{RMeet\}\(U,V\)\\lor\\mathrm\{A2AMeet\}\(U,V\)
19:ifnot

Meet​\(U,V\)\\mathrm\{Meet\}\(U,V\)then

20:continue

21:endif

22:

Φres​\(U→V\)←0\\Phi\_\{\\mathrm\{res\}\}\(U\\to V\)\\leftarrow 0
23:if

RMeet​\(U,V\)\\mathrm\{RMeet\}\(U,V\)then

24:

\(aU​Vmeet,bU​Vmeet\)←\(a^\{\\mathrm\{meet\}\}\_\{UV\},b^\{\\mathrm\{meet\}\}\_\{UV\}\)\\leftarrowany element of

ℳ​\(U,V\)\\mathcal\{M\}\(U,V\)
25:

rU​V←node⁡\(aU​Vmeet\)r\_\{UV\}\\leftarrow\\operatorname\{node\}\(a^\{\\mathrm\{meet\}\}\_\{UV\}\)
26:Store

\(𝖱𝖾𝗌𝗈𝗎𝗋𝖼𝖾,U,V,aU​Vmeet,bU​Vmeet,rU​V\)\(\\mathsf\{Resource\},U,V,a^\{\\mathrm\{meet\}\}\_\{UV\},b^\{\\mathrm\{meet\}\}\_\{UV\},r\_\{UV\}\)in

𝖬𝖾𝖾𝗍𝗂𝗇𝗀𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌\\mathsf\{MeetingWitnesses\}
27:

Φres​\(U→V\)←Span⁡\(𝒲​\(U\),ℛ​\(V\)\)\\Phi\_\{\\mathrm\{res\}\}\(U\\to V\)\\leftarrow\\operatorname\{Span\}\(\\mathcal\{W\}\(U\),\\mathcal\{R\}\(V\)\)
28:endif

29:

ΦA2A​\(U,V\)←0\\Phi\_\{\\mathrm\{A2A\}\}\(U,V\)\\leftarrow 0
30:if

A2AMeet​\(U,V\)\\mathrm\{A2AMeet\}\(U,V\)then

31:Store

\(𝖠𝟤𝖠,\{U,V\}\)\(\\mathsf\{A2A\},\\\{U,V\\\}\)in

𝖬𝖾𝖾𝗍𝗂𝗇𝗀𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌\\mathsf\{MeetingWitnesses\}
32:

ΦA2A​\(U,V\)←Span⁡\(𝒜​\(U\),𝒜​\(V\)\)\\Phi\_\{\\mathrm\{A2A\}\}\(U,V\)\\leftarrow\\operatorname\{Span\}\(\\mathcal\{A\}\(U\),\\mathcal\{A\}\(V\)\)
33:endif

34:

Φ​\(U→V\)←max⁡\{Φres​\(U→V\),ΦA2A​\(U,V\)\}\\Phi\(U\\to V\)\\leftarrow\\max\\\{\\Phi\_\{\\mathrm\{res\}\}\(U\\to V\),\\Phi\_\{\\mathrm\{A2A\}\}\(U,V\)\\\}
35:if

Φ​\(U→V\)≥θ\\Phi\(U\\to V\)\\geq\\thetathen

36:Add

\(U→V\)\(U\\to V\)to

EθE\_\{\\theta\}
37:endif

38:endfor

39:

G​\(θ\)←\(𝒰,Eθ\)G\(\\theta\)\\leftarrow\(\\mathcal\{U\},E\_\{\\theta\}\)
40:Phase 3: Effective autonomy and policy conditions

41:

H←G​\(θ\)H\\leftarrow G\(\\theta\)
42:Initialize

𝖵𝗂𝗈𝗅𝖺𝗍𝗂𝗈𝗇𝗌←∅\\mathsf\{Violations\}\\leftarrow\\varnothing
43:Compute directed reachability

↝H\\leadsto\_\{H\}in

HH
44:foreach

U∈𝒰U\\in\\mathcal\{U\}do

45:

ℰH​\(U\)←⋃\{𝒜​\(V\):V∈𝒰,U↝H∗V\}\\mathcal\{E\}\_\{H\}\(U\)\\leftarrow\\bigcup\\\{\\mathcal\{A\}\(V\):V\\in\\mathcal\{U\},\\ U\\leadsto\_\{H\}^\{\*\}V\\\}
46:

βH​\(U\)←0\\beta\_\{H\}\(U\)\\leftarrow 0
47:

\(aU⋆,bU⋆\)←⊥\(a\_\{U\}^\{\\star\},b\_\{U\}^\{\\star\}\)\\leftarrow\\bot
48:foreach unordered pair

\{a,b\}⊆ℰH​\(U\)\\\{a,b\\\}\\subseteq\\mathcal\{E\}\_\{H\}\(U\)with

a≠ba\\neq bdo

49:

ρ←d𝒜​\(a,b\)\\rho\\leftarrow d\_\{\\mathcal\{A\}\}\(a,b\)
50:if

ρ\>βH​\(U\)\\rho\>\\beta\_\{H\}\(U\)then

51:

βH​\(U\)←ρ\\beta\_\{H\}\(U\)\\leftarrow\\rho
52:

\(aU⋆,bU⋆\)←\(a,b\)\(a\_\{U\}^\{\\star\},b\_\{U\}^\{\\star\}\)\\leftarrow\(a,b\)
53:endif

54:endfor

55:if

βH​\(U\)\>τaut\\beta\_\{H\}\(U\)\>\\tau\_\{\\mathrm\{aut\}\}then

56:Record

\(𝖡𝗅𝖺𝗌𝗍𝖱𝖺𝖽𝗂𝗎𝗌,U,aU⋆,bU⋆,βH​\(U\),τaut\)\(\\mathsf\{BlastRadius\},U,a\_\{U\}^\{\\star\},b\_\{U\}^\{\\star\},\\beta\_\{H\}\(U\),\\tau\_\{\\mathrm\{aut\}\}\)in

𝖵𝗂𝗈𝗅𝖺𝗍𝗂𝗈𝗇𝗌\\mathsf\{Violations\}
57:endif

58:endfor

59:foreach

\(U,V\)∈Eθ\(U,V\)\\in E\_\{\\theta\}do

60:if

\(U,V\)∉𝖠𝗅𝗅𝗈𝗐\(U,V\)\\notin\\mathsf\{Allow\}then

61:Record

\(𝖴𝗇𝖺𝗎𝗍𝗁𝗈𝗋𝗂𝗓𝖾𝖽𝖨𝗇𝖿𝗅𝗎𝖾𝗇𝖼𝖾,U,V,Φ​\(U→V\)\)\(\\mathsf\{UnauthorizedInfluence\},U,V,\\Phi\(U\\to V\)\)in

𝖵𝗂𝗈𝗅𝖺𝗍𝗂𝗈𝗇𝗌\\mathsf\{Violations\}
62:endif

63:endfor

64:Construct

H¯\\overline\{H\}and its non\-singleton weak components

\{C1,…,Ck\}\\\{C\_\{1\},\\ldots,C\_\{k\}\\\}
65:Phase 4: Collusion evaluation

66:Initialize

𝖢𝗈𝗅𝗅𝗎𝗌𝗂𝗈𝗇𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌←∅\\mathsf\{CollusionWitnesses\}\\leftarrow\\varnothing
67:foreach component

C∈\{C1,…,Ck\}C\\in\\\{C\_\{1\},\\ldots,C\_\{k\}\\\}do

68:

𝗁𝖺𝗌𝖶𝗂𝗍𝗇𝖾𝗌𝗌​\(C\)←false\\mathsf\{hasWitness\}\(C\)\\leftarrow\\mathrm\{false\}
69:foreach ordered pair

\(U,V\)∈C×C\(U,V\)\\in C\\times Cwith

U≠VU\\neq Vdo

70:if

Gates​\(U,V\)\\mathrm\{Gates\}\(U,V\)and

U↝HVU\\leadsto\_\{H\}Vthen

71:Record an authorization\-composition witness for

CC
72:Store the witness in

𝖢𝗈𝗅𝗅𝗎𝗌𝗂𝗈𝗇𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌\\mathsf\{CollusionWitnesses\}
73:

𝗁𝖺𝗌𝖶𝗂𝗍𝗇𝖾𝗌𝗌​\(C\)←true\\mathsf\{hasWitness\}\(C\)\\leftarrow\\mathrm\{true\}
74:endif

75:if

Gates​\(U,V\)\\mathrm\{Gates\}\(U,V\)and

V↝HUV\\leadsto\_\{H\}Uthen

76:Record a decision\-manipulation witness for

CC
77:Store the witness in

𝖢𝗈𝗅𝗅𝗎𝗌𝗂𝗈𝗇𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌\\mathsf\{CollusionWitnesses\}
78:

𝗁𝖺𝗌𝖶𝗂𝗍𝗇𝖾𝗌𝗌​\(C\)←true\\mathsf\{hasWitness\}\(C\)\\leftarrow\\mathrm\{true\}
79:endif

80:foreach ordered domain pair

\(i,j\)\(i,j\)with

i⟂polji\\perp\_\{\\mathrm\{pol\}\}jdo

81:if

U↝HVU\\leadsto\_\{H\}Vand

Loc⁡\(ℰH​\(U\)\)∩𝒟i≠∅\\operatorname\{Loc\}\(\\mathcal\{E\}\_\{H\}\(U\)\)\\cap\\mathcal\{D\}\_\{i\}\\neq\\varnothingand

Loc⁡\(ℰH​\(V\)\)∩𝒟j≠∅\\operatorname\{Loc\}\(\\mathcal\{E\}\_\{H\}\(V\)\)\\cap\\mathcal\{D\}\_\{j\}\\neq\\varnothingthen

82:Record a cross\-domain\-composition witness for

CC
83:Store the witness in

𝖢𝗈𝗅𝗅𝗎𝗌𝗂𝗈𝗇𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌\\mathsf\{CollusionWitnesses\}
84:

𝗁𝖺𝗌𝖶𝗂𝗍𝗇𝖾𝗌𝗌​\(C\)←true\\mathsf\{hasWitness\}\(C\)\\leftarrow\\mathrm\{true\}
85:endif

86:endfor

87:endfor

88:if

𝗁𝖺𝗌𝖶𝗂𝗍𝗇𝖾𝗌𝗌​\(C\)\\mathsf\{hasWitness\}\(C\)then

89:Flag

CCas collusion\-positive

90:Record

\(𝖢𝗈𝗅𝗅𝗎𝗌𝗂𝗈𝗇,C\)\(\\mathsf\{Collusion\},C\)in

𝖵𝗂𝗈𝗅𝖺𝗍𝗂𝗈𝗇𝗌\\mathsf\{Violations\}
91:endif

92:endfor

93:Phase 5: Least\-autonomy decision

94:if

𝖵𝗂𝗈𝗅𝖺𝗍𝗂𝗈𝗇𝗌=∅\\mathsf\{Violations\}=\\varnothingthen

95:

LeastAutonomy←true\\mathrm\{LeastAutonomy\}\\leftarrow\\mathrm\{true\}
96:else

97:

LeastAutonomy←false\\mathrm\{LeastAutonomy\}\\leftarrow\\mathrm\{false\}
98:endif

99:return

G​\(θ\)G\(\\theta\),

Φ\\Phi,

\{ℰH​\(U\)\}U∈𝒰\\\{\\mathcal\{E\}\_\{H\}\(U\)\\\}\_\{U\\in\\mathcal\{U\}\},

\{βH​\(U\)\}U∈𝒰\\\{\\beta\_\{H\}\(U\)\\\}\_\{U\\in\\mathcal\{U\}\},

𝖬𝖾𝖾𝗍𝗂𝗇𝗀𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌\\mathsf\{MeetingWitnesses\},

𝖢𝗈𝗅𝗅𝗎𝗌𝗂𝗈𝗇𝖶𝗂𝗍𝗇𝖾𝗌𝗌𝖾𝗌\\mathsf\{CollusionWitnesses\},

𝖵𝗂𝗈𝗅𝖺𝗍𝗂𝗈𝗇𝗌\\mathsf\{Violations\}, and

LeastAutonomy\\mathrm\{LeastAutonomy\}