ProceedingsFull paper
Sandboxing Agent Tool Calls with Capability Tokens
Tool-using agents are typically granted broad credentials, so a single injected instruction can cause large harm. We describe a capability-token scheme in which every tool call carries a narrowly scoped, short-lived token issued by a policy layer outside the model. A prototype blocks all 41 attack scripts in our test suite with under 4 ms of added latency.