You can't write a specification for a system that generates new capabilities at runtime.
LLM agents create tools, chain actions, and adapt their behavior based on natural language instructions. Their full functionality set is not knowable before execution. Traditional access control assumes you can enumerate what a system is allowed to do. Agentic systems violate this assumption — the set of possible actions changes with every prompt.
Sequeira, Damianakis, Iqbal, and Psounis (arXiv:2603.22868) propose Agent-Sentry, which learns behavioral bounds from execution provenance rather than specifying them in advance. Observe what the agent does during normal operation. Record the execution traces — which tools are called, in what order, with what parameters. Build a model of frequent functionalities. Then block tool calls that deviate from learned patterns or misalign with user objectives.
The approach prevents over 90% of out-of-bounds execution attacks while preserving approximately 98% of system functionality. The key insight is that the boundary is empirical, not logical. You don't define what's allowed; you observe what's normal and flag deviations.
This inverts the traditional security model. Instead of “deny by default, allow by policy,” it's “learn what normal looks like, deny the abnormal.” The provenance trace — the history of what was actually executed — becomes the security specification. The specification is a posteriori, written by the system's own behavior.
The limitation is obvious: an attacker who can gradually shift the agent's behavior within the learned boundary can expand what counts as “normal” without triggering detection. The boundary is only as good as the training period. But for agents whose capabilities evolve with use, a learned boundary is the only kind possible.