Dynamic Capability Scoping for Enterprise AI Agents: A Synthetic Dataset and Three-Source Permission Architecture

A new paper on arXiv (2607.22445) proposes a dynamic least-privilege principle for enterprise AI agents, arguing that static credential sets at configuration time create over-privilege and expand the attack surface. The authors outline a three-source architecture consisting of role-based ceilings, a task-context classifier, and policy-derived combination prohibitions to form a layered proactive defense against LLM agent misalignment and misuse. The architecture supports both enforcing and observe-only deployment modes, with the latter recording permission requests inconsistent with task context to produce behavioral signals for misalignment research. The paper emphasizes that capability scoping must be treated as a prevention mechanism before detection, as credentials absent from an agent's context cannot be misused regardless of reasoning or evasion sophistication.