做AI安全或智能体部署的团队会关心——这篇论文揭示了当前编码智能体在权限管理上的根本缺陷，并给出了可落地的分解方案，值得直接参考。
该论文研究了编码智能体在执行终端任务时，能否自主推断出最小权限授权边界。作者提出了权限边界推断任务和AuthBench基准测试，包含120个真实终端任务及人工审核的权限标签。实验发现，前沿模型在授权时往往既遗漏必要权限又授予多余敏感权限，且增加推理时间并不能解决这一问题，反而使模型趋向于各自的授权吸引子（要么过于宽松，要么过于严格）。为此，作者提出了充分性-紧致性分解方法，先通过前向模拟生成覆盖性策略，再审计每个授权项的合理性，该方法在多个模型上提升了敏感任务成功率并降低了攻击成功率。
As coding agents gain access to shells, repositories, and user files, least-privilege authorization becomes a prerequisite for safe deployment: an agent should receive enough authority to complete the task, without unnecessary authority that exposes sensitive surfaces.To study whether current models can infer this boundary themselves, we first introduce permission-boundary inference, where a model maps a task instruction and terminal environment to a file-level read/write/execute policy, and AuthBench, a benchmark of 120 realistic terminal tasks with human-reviewed permission labels and executable validators for utility and attack outcomes.AuthBench shows that authorization is not a simple conservative-versus-permissive calibration problem: frontier models often omit permissions required by the execution chain while also granting unused or sensitive accesses.Increasing inference-time reasoning does not resolve this mismatch. Instead, each model moves toward a model-specific authorization attractor: more reasoning makes it more consistent in its own failure mode, whether broad-but-exposed or tight-but-brittle.This suggests that direct policy generation is the bottleneck, because a single generation must both discover all necessary accesses and reject all unnecessary ones.We therefore propose Sufficiency-Tightness Decomposition, which first generates a coverage-oriented policy by forward-simulating the task and then audits each granted entry for grounding and sensitivity.Across tested models, this decomposition improves sensitive-task success by up to 15.8% on tightness-biased models while reducing attack success across all evaluated models.