做AI智能体运维或安全治理的团队终于有了一个轻量级工具来告诉智能体哪些资源不能碰，实测效果显著，建议直接看实验设计和适配器实现。
论文提出了一种轻量级协议——Recuse Signal，允许服务器通过现有协议通道（如SSH横幅、PostgreSQL NOTICE）向连接的LLM智能体发送“请退出”信号，类似于robots.txt对爬虫的控制。实验表明，在SSH场景下，该信号能100%诱导智能体退出，而对照组则100%完成任务。但该信号是合作性而非绝对性的：当操作员明确授权时，最强模型会继续执行，其他模型则仍遵循主机策略。研究释放了标准、适配器和实验工具，为智能体行为治理提供了新思路。
Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals
As autonomous LLM agents increasingly hold real credentials and operate infrastructure without a human in the loop, operators have no standard way to tell an agent that a resource is off-limits. Access controls either let the agent in (it has valid credentials) or hard-fail it (indistinguishable from any other client). We propose a third mode: a lightweight, published in-band deny signal -- the Recuse Signal -- that a server emits over a protocol's existing channels (an SSH banner, a PostgreSQL NOTICE) asking a connecting automated agent to voluntarily withdraw. This is a cooperative governance control, the robots.txt analogue for live access; it is explicitly not a security boundary. Its value is entirely empirical and, to our knowledge, unmeasured: do compliant LLM agents actually honor such a signal? We define the signal as an open mini-standard, implement two zero- or low-footprint adapters (an SSH banner/PAM hook and a PostgreSQL wire-protocol proxy), deploy them on a live production host, and run a controlled experiment in which fresh agents are given a benign operations task and observed for recusal. In a pilot (SSH; OpenAI GPT-4o and GPT-4o-mini; and Claude Code as a deployed agent), the signal cleanly induces recusal -- 100% recusal when present versus 100% task completion in a no-signal control -- and, revealingly, behaves as a cooperative rather than absolute signal: an explicit operator-authorization framing flips the most capable model to proceed, while other agents continue to defer to the on-host policy. We release the standard, adapters, and experiment harness for reproduction.