An agent-oriented access control method and device, electronic equipment and medium

Abstract

The application provides an agent-oriented access control method and device, electronic equipment and medium. The method comprises: obtaining the current session and original real intention text of a user and an agent; analyzing the original real intention text to identify the task boundary and construct an expected tool call graph bound with a minimum permission set and node attribute; intercepting a current tool call request issued by a runtime, combining a historical request that has been released to generate an actual tool call graph; comparing the two graphs based on a baseline cursor set to determine the deviation type and target deviation value corresponding to the target deviation, and determining the necessary node step deviation when skipping the necessary node that has not been completed; and performing access control processing according to the target deviation value. The application can implement fine-grained permission control according to the task logic track, and reduce the risk of the agent deviating from the initial intention of the user and improperly calling external tools.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and information security technology, and in particular to an access control method, device, electronic device and medium for intelligent agents. Background Technology

[0002] With the continuous evolution of artificial intelligence technology, intelligent agents driven by large language models have been widely used in various business scenarios. To autonomously complete complex business processes, intelligent agents typically invoke various external tools and services based on their internal task planning logic, such as performing database queries, file read / write operations, and initiating application programming interface (API) requests. This interaction mode, reliant on external tools, grants intelligent agents greater execution freedom, enabling them to handle more diverse task requirements.

[0003] In existing tool invocation processes, the system typically grants agents basic global operational permissions during the agent initialization phase and relies on the model's own contextual reasoning capabilities to determine the specific invocation order and parameter passing. However, in complex and long-term interaction sessions, dynamic changes in the external environment and the intervention of untrusted data sources can easily lead to unintended guidance of the agent's control flow. Due to the lack of fine-grained process supervision mechanisms, it is difficult for the system to quantify the deviation between the agent's actual operational trajectory and the user's initial true intent in real time during agent operation.

[0004] When an agent initiates multiple tool call requests consecutively, conventional access control policies often fail to dynamically grant or deny permissions based on the specific task topology. In multi-stage complex tasks, static permission configurations can easily lead to the prolonged overexposure of resource permissions. If the agent receives misleading abnormal return data during intermediate processing, it may directly trigger out-of-level calls or parameter semantic jumps, thereby adversely affecting the overall data security and execution reliability of the intelligent business processing system. Summary of the Invention

[0005] The purpose of this invention is to provide an access control method, device, electronic device, and medium for intelligent agents, in order to solve the security problems mentioned in the background art, such as the difficulty in quantifying the deviation between the intelligent agent's call trajectory and the user's expectations in real time, and the security problems that static permission configuration can easily lead to excessive exposure of permissions.

[0006] In a first aspect, the present invention provides an access control method for intelligent agents, applied to an intelligent business processing system, comprising: Obtain the current session between the user and the agent, and identify the user's original true intent text at the start of the current session; Semantic parsing is performed on the original true intent text to identify the task boundary corresponding to the original true intent text; Based on the task boundary, a expected tool call graph is constructed. Nodes in the expected tool call graph represent tools to be called, directed edges represent the call order, each node is bound to a minimum set of permissions, and is labeled with a mandatory or optional attribute and a maximum number of repeated calls. The mandatory attribute is used to characterize that the corresponding task must rely on external tools for processing, and the optional attribute is used to characterize that the corresponding task can be completed by the agent's own context reasoning ability. Intercept the current tool call request issued by the agent during runtime, and combine the actual tools called in all the tool call requests that were allowed before this request, as well as the actual calling order between each actual tool, to generate an actual tool call graph in real time; Based on a pre-maintained set of baseline cursors, the actual tool call graph is compared with the expected tool call graph to determine the target deviation. The set of baseline cursors indicates candidate tool nodes that are allowed to be called under the current execution progress. If the tool node corresponding to the current tool call request does not belong to the set of baseline cursors, and the tool node corresponding to the current tool call request is located at the successor level of a node with the required path attribute that has not yet been completed in the set of baseline cursors, then the deviation type corresponding to the target deviation is determined to include a required path node skip deviation. Based on the target deviation, perform access control processing on the current tool call request.

[0007] Optionally, the step of comparing the actual tool call graph with the expected tool call graph to determine the target deviation further includes: If the actual tool call graph contains a target node that does not belong to the expected tool call graph, lacks an expected node in the expected tool call graph, or the actual node's tool type is inconsistent with the corresponding expected node, then a first deviation is determined. If the actual calling order of each node in the actual tool calling graph violates the direction of the directed edges between corresponding nodes in the expected tool calling graph, then a second deviation is determined; If the actual tool call graph skips a node with the required attribute that has not yet been completed in the expected tool call graph, then a third deviation is determined, which is the skip deviation of the required node; For each node in the actual tool call graph, if the semantic similarity between the call parameters of the node and the expected semantics of the corresponding node in the expected tool call graph is lower than a preset similarity threshold, then a fourth deviation is determined. The target deviation includes a deviation type and a target deviation value. The deviation type includes at least one of the first deviation, the second deviation, the third deviation, and the fourth deviation. The target deviation value is obtained by weighting the deviation components corresponding to the determined deviations according to preset weights.

[0008] Optionally, determining the first deviation and the second deviation includes: The graph edit distance algorithm is used to calculate the sequence of editing operations required to transform the actual tool call graph into the expected tool call graph. The sequence of editing operations includes at least one of node insertion, node replacement, node deletion, edge insertion, edge deletion, and edge reversal. If the sequence of edit operations includes the node insertion operation, the node replacement operation, or the node deletion operation, then the first deviation is determined; If the editing operation sequence includes the edge insertion operation, the edge deletion operation, or the edge reversal operation, then the second deviation is determined.

[0009] Optionally, after performing access control processing on the current tool invocation request based on the target deviation, the method further includes a baseline cursor dynamic update step, specifically including: After the current tool call request is approved and the corresponding node has been executed, the direct successor node of the node in the expected tool call graph is added to the baseline cursor set. If a node with the optional attribute exists among the direct successor nodes, a recursive search is performed along the topological successor direction of the node with the optional attribute, and the found topological successor node is simultaneously included in the baseline cursor set.

[0010] Optionally, performing access control processing on the current tool invocation request based on the target deviation includes: If the target deviation value is less than the preset first single-step deviation threshold, then the current tool call request is allowed; If the target deviation value is greater than or equal to the first single-step deviation threshold and less than the preset second single-step deviation threshold, then the execution thread of the agent is suspended, the permissions of the agent are frozen, and manual intervention confirmation is triggered. If the target deviation value is greater than or equal to the second single-step deviation threshold and less than the preset third single-step deviation threshold, the current tool call request is rejected, and the agent is instructed to roll back to replan the call path. If the target deviation value is greater than or equal to the preset third single-step deviation threshold, the current tool call request is directly rejected, an alarm is issued, and the context of the current session is destroyed; the third single-step deviation threshold is greater than the second single-step deviation threshold, and the second single-step deviation threshold is greater than the first single-step deviation threshold.

[0011] Optionally, after performing access control processing on the current tool invocation request based on the target deviation, the method further includes a tainted data marking and call chain mutation detection step, specifically including: After the current tool call request is allowed and executed, if the returned data from the tool call comes from an untrusted data source, the returned data is marked as tainted data. In the current session, if tool call return data marked as tainted data enters the context of the current session, then for tool call requests that appear within the effective window after entering the context, call chain mutation detection is performed; If a call chain mutation is detected, the target deviation value corresponding to the tool call request appearing within the effective window is weighted with a penalty factor greater than the default value; The call chain mutation detection includes detecting at least one of the following: insertion of abnormal nodes, order reversal, skipping steps, parameter semantic jumps, and the cumulative number of repeated calls to the same node exceeding the corresponding maximum number of repeated calls.

[0012] Optionally, after constructing the expected tool call graph, the method further includes a phased dynamic authorization step based on graph topology sorting, specifically including: The expected tool call graph is topologically sorted, and the nodes in the expected tool call graph are divided into multiple stages, with each stage corresponding to at least one node in the same topological layer of the expected tool call graph; When the agent starts, it is granted only the permissions from the minimum permission set bound to the node corresponding to the initial stage of execution. During the operation of the current session, in response to the fact that all nodes with the required attributes in the current stage have been executed and the cumulative number of calls of each node in the current stage has not exceeded the corresponding maximum number of repeated calls, the agent's permissions are updated from the minimum permission set corresponding to the current stage to the minimum permission set corresponding to the next stage, and the permissions of the current stage are revoked.

[0013] Secondly, the present invention provides an access control device for intelligent agents, applied to an intelligent business processing system, comprising: The acquisition module is used to acquire the current session between the user and the intelligent agent, and to identify the user's original true intent text at the start of the current session; The task boundary determination module is used to perform semantic parsing on the original true intent text and identify the task boundary corresponding to the original true intent text. The expected tool call graph construction module is used to construct an expected tool call graph based on the task boundary. Nodes in the expected tool call graph represent pre-called tools, directed edges represent the call order, each node is bound to a minimum set of permissions, and is labeled with a mandatory or optional attribute and a maximum number of repeated calls. The mandatory attribute is used to characterize that the corresponding task must rely on external tools for processing, and the optional attribute is used to characterize that the corresponding task can be completed by the agent's own context reasoning ability. The actual tool call graph generation module is used to intercept the current tool call request issued by the agent during runtime, and generate an actual tool call graph in real time by combining the actual calling tools in all the tool call requests that were allowed before this request and the actual calling order between each actual calling tool. The target deviation determination module is used to determine the target deviation by comparing the actual tool call graph with the expected tool call graph based on a pre-maintained baseline cursor set. The baseline cursor set indicates candidate tool nodes that are allowed to be called under the current execution progress. If the tool node corresponding to the current tool call request does not belong to the baseline cursor set, and the tool node corresponding to the current tool call request is located at the successor level of a node with the mandatory attribute that has not yet been completed in the baseline cursor set, then the deviation type corresponding to the target deviation is determined to include mandatory node skip deviation. The access control module is used to perform access control processing on the current tool call request based on the target deviation.

[0014] Thirdly, the present invention provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in any one of the first aspects.

[0015] Fourthly, the present invention provides a computer-readable storage medium on which a computer program is stored, wherein the computer program, when executed by a processor, implements the method described in any one of the first aspects.

[0016] The present invention has achieved the following beneficial effects: This invention constructs a projected tool call graph by parsing the original true intent text and compares it in real time with the dynamically generated actual tool call graph. This allows for the identification of deviation types, including deviations from necessary node skips, and the calculation of corresponding target deviation values, providing a quantitative basis for access control processing. Simultaneously, this invention introduces a stage-based dynamic authorization mechanism based on directed acyclic graph topology sorting. This ensures that the agent holds only the minimum set of permissions required to complete the current local operation at each stage, and reclaims the corresponding permissions upon completion of the stage node, reducing the continuous exposure of permissions caused by static authorization. Furthermore, this invention combines tainted data marking and call chain mutation detection mechanisms to adjust the penalty factor and weight the target deviation value when an abnormal call sequence is detected, thereby improving the reliability of access control in long-term operation and under conditions of untrusted data source intervention.

[0017] Other features and advantages of the invention will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention may be realized and obtained by means of the structures particularly pointed out in the written description and the accompanying drawings.

[0018] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0019] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a schematic diagram of the architecture of an intelligent business processing system provided in an embodiment of the present invention; Figure 2 A flowchart illustrating an access control method for intelligent agents provided in an embodiment of the present invention; Figure 3 This invention provides a schematic diagram of a logical judgment process for performing access control processing on a current tool call request, as provided in an embodiment of the invention. Figure 4 A flowchart illustrating an embodiment of the present invention that introduces a tainted data marking and call chain mutation detection mechanism; Figure 5 A block diagram of an access control device for intelligent agents provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0020] The embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0021] This application provides an access control method, apparatus, electronic device, and medium for intelligent agents, applied to an intelligent business processing system. It is understood that the intelligent business processing system is configured to support the operation of intelligent agents driven by large language models in specific business scenarios. For example... Figure 1 As shown, the architecture of the intelligent business processing system includes a user interaction interface, an intelligent agent execution engine, a tool call interception proxy layer, an access control decision center, and an external tool service cluster. The intelligent agent execution engine is responsible for running a large language model for task planning, and the external tool service cluster provides entity tools including database queries, file read / write operations, and application programming interface (API) requests. The tool call interception proxy layer is deployed between the intelligent agent execution engine and the external tool service cluster in a bypass or in-line manner, configured to intercept all tool call requests at the network communication protocol layer or function call interface layer.

[0022] In this embodiment, as Figure 2 As shown, the agent-oriented access control method includes the following steps: The system acquires the current session between the user and the intelligent agent and identifies the user's original true intent text at the start of the current session. Specifically, when the intelligent business processing system receives an interaction request from the user, it generates a unique session identifier to establish the current session. The system continuously records the data flow sequence within the current session. The process of identifying the original true intent text includes extracting the earliest timestamped text data directly input by the user through the interaction interface in the current session. Further, the system is configured with a data source identification mechanism to distinguish between credible intent source text and untrusted data source text through data source identifiers. The credible intent source text specifically refers to text directly typed by the user through a legitimate terminal device; the untrusted data source text includes external tool return values ​​received by the intelligent agent during operation, system search content, and third-party application push messages. When extracting the original true intent text, the system only extracts text with credible intent source identifiers and excludes all text with untrusted data source identifiers. This mechanism cuts off the data link that uses untrusted external data as the basis for task objectives.

[0023] The original true intent text is semantically parsed to identify the task boundary corresponding to it. The task boundary characterizes the range of data resources and operations required to complete the current task. Specifically, the semantic parsing process is executed by the natural language processing module deployed in the intelligent business processing system. The natural language processing module performs word segmentation, part-of-speech tagging, and dependency parsing on the original true intent text to extract the target entity, the action verb, and the expected output form representing the current task. Specifically, the natural language processing module adopts a Named Entity Recognition (NER) architecture combining a bidirectional long short-term memory network (BiLSTM-CRF). The BiLSTM layer captures global sequence features of the context, and the CRF layer constrains the transition probability of entity labels to extract the target entity. The action verb is determined through the root node (ROOT) of the dependency parsing tree and its core dependency relations (such as verb-object relations VOB). The system determines the data resource range based on the extracted target entity, which limits the data source identifier, database table structure, and file directory path that are legally accessible for this task. The system determines the scope of operations based on the extracted action verbs. This scope limits the types of actions the agent can perform, including read-only access, local memory computation, and writing to a specified path. Further, the natural language processing module decomposes the original true intent text into an ordered sequence of multiple atomic subtasks, each of which constitutes an indivisible operational unit. During semantic parsing, if the parsing confidence score output by the natural language processing module is lower than a preset confidence threshold, it indicates ambiguity in the determination of the task boundary, and the system triggers a degraded execution mode. In this degraded execution mode, the system limits the scope of operations to a global read-only scope and outputs a clarification request at the user interface, asking the user to provide additional intent details.

[0024] Based on the task boundaries, a projected tool call graph is constructed. Nodes in the projected tool call graph represent pre-called tools, directed edges represent the call order, each node is bound to a minimum set of permissions, and is labeled with mandatory or optional attributes and a maximum number of repeated calls. Specifically, the data structure of the projected tool call graph is a directed acyclic graph. Based on the atomic subtask sequence obtained from the aforementioned semantic parsing, the system maps each atomic subtask to a pre-registered tool type in the system, generating the node set of the projected tool call graph. During the mapping process, the system reads a pre-stored tool capability snapshot file. This tool capability snapshot file is generated during system initialization and contains standard functional descriptions, parameter input modes, and resource access categories for each external tool, along with a hash checksum to ensure data integrity. The system prohibits reading dynamic tool descriptions during agent runtime when constructing the projected tool call graph, thereby isolating uncontrollable variables introduced by the dynamic environment.

[0025] After generating the node set, the system generates a set of directed edges connecting the corresponding nodes based on the data dependencies and logical sequence relationships between the various atomic subtasks. These directed edges indicate the direction of data flow between different pre-invoked tools and the timing constraints of their execution.

[0026] For each node in the expected tool call graph, the system generates and binds a minimum permission set based on the task boundaries. The data structure of the minimum permission set includes allowed resource Uniform Resource Locators (URIs), allowed execution instructions, and data processing thresholds. This minimum permission set ensures that when an agent executes a tool at a corresponding node, it only has the resource access permissions required to complete that computational unit. Calls exceeding the scope of the minimum permission set are intercepted by hardware or software mechanisms within the operating system sandbox layer.

[0027] Simultaneously, the system configures attribute labels for each node in the expected tool call graph. These attribute labels include mandatory and optional attributes. If the corresponding atomic subtask must rely on an external tool for processing, the system marks the node as having the mandatory attribute; if the corresponding atomic subtask can be completed using the agent's large language model's own contextual reasoning capabilities, the system marks the node as having the optional attribute. Furthermore, the system configures a maximum number of repeated calls for each node based on business logic rules. These business logic rules are generated based on the API gateway rate limiting configuration and pagination query specifications of the external tool. For example, when the target tool type is a database pagination query interface, the maximum number of repeated calls is set to the maximum pagination depth allowed in a single transaction for that interface (e.g., 50 times); when the target tool is a regular instruction execution interface, this number is set to 3 by default to prevent infinite loops. The maximum number of repeated calls parameter limits the upper limit of consecutive call operations that the agent can initiate on the same tool type without violating the expected logic, ensuring compatibility with common application scenarios such as pagination queries and batch data segmentation processing.

[0028] The system intercepts the current tool call request issued by the agent during runtime and, by combining the actual calling tools from all previously allowed tool call requests and the actual calling order among these tools, generates a real-time tool call graph. Specifically, the tool call interception proxy layer captures the data packet of the current tool call request before the agent initiates a network request or inter-process communication to an external tool service cluster. The data packet of the current tool call request contains a target tool identifier and a structured set of call parameters. The proxy layer extracts the target tool identifier and instantiates an actual calling node in memory. The system maintains a historical call record stack, which stores information on all historical tool call requests that have been reviewed and allowed in the current session. Based on the timestamp order of each allowed call in the historical call record stack and the data context transmission relationship, the system establishes actual directed edges between existing actual calling nodes and newly instantiated actual calling nodes. As the agent's operation progresses, the system incrementally assembles and generates the real tool call graph in memory through the cyclical process of node instantiation and directed edge establishment described above. During the generation of the actual tool call graph, if the system detects that an agent initiates continuous calls to the same target tool identifier and the number of calls does not exceed the corresponding maximum number of repeated calls, the system does not generate new independent nodes in the actual tool call graph, but updates the state counters of existing logical nodes to compress the topological complexity of the graph.

[0029] Based on a pre-maintained set of baseline cursors, the actual tool call graph is compared with the expected tool call graph to determine the target deviation. The target deviation includes a deviation type and a target deviation value; the deviation type includes at least one of a first deviation, a second deviation, a third deviation, and a fourth deviation; the target deviation value is calculated by weighting the deviation components corresponding to each determined deviation according to preset weights. To quantify the degree of deviation between the agent's actual execution trajectory and the user's expected intent, the system execution graph topology is compared, and parameter semantics are compared.

[0030] Regarding the determination process of the first deviation and the second deviation, the system calls the graph editing distance calculation module, using the expected tool call graph as the target graph mode and the actual tool call graph as the source graph mode, to calculate the editing operation sequence required to transform the source graph mode into the target graph mode. The system defines operation codes for different types of editing operations, and the editing operation sequence includes at least one of node insertion, node replacement, node deletion, edge insertion, edge deletion, and edge reversal operations. If the editing operation sequence includes a node insertion, node replacement, or node deletion operation, the system determines the first deviation; if the editing operation sequence includes an edge insertion, edge deletion, or edge reversal operation, the system determines the second deviation.

[0031] Regarding the determination process of the third deviation, the system initializes and continuously maintains the baseline cursor set in memory. The baseline cursor set is used to indicate candidate tool nodes that are allowed to be called under the current execution progress. During the session initialization phase, the system adds all nodes with an in-degree of zero in the expected tool call graph to the baseline cursor set. When the proxy layer intercepts the current tool call request, the system extracts its corresponding tool node and retrieves the baseline cursor set. If the tool node corresponding to the current tool call request does not belong to the baseline cursor set, the system locates the tool node in the global topology of the expected tool call graph. If the location result shows that the tool node is located at the successor level of a node in the baseline cursor set that is not yet completed and has the required path attribute, it is determined that the actual tool call graph skips the uncompleted required path node, and the system determines the third deviation, i.e., the required path node skip deviation. In the normal control flow, after the system allows the current tool call request and monitors the completion of the corresponding tool node, it searches for the direct successor node of the completed node in the expected tool call graph and adds the direct successor node to the baseline cursor set. If a node with the optional attribute exists among the direct successor nodes, the system recursively searches along the topological successor direction of the node with the optional attribute, and simultaneously includes the found topological successor node into the baseline cursor set, so that the agent can continue to request subsequent tools when completing the optional task through contextual reasoning.

[0032] To determine the fourth bias, the system performs parameter semantic verification. For each node in the actual tool call graph, the system extracts the call parameter set recorded by that node and calls a pre-deployed text embedding model to convert the call parameter set into an actual semantic vector composed of multi-dimensional floating-point numbers. In this embodiment, the text embedding model adopts a pre-trained Sentence-BERT (SBERT) network structure. The system serializes the call parameter set into key-value pair strings and inputs them into the Transformer encoder layer of the SBERT model, extracts the last hidden state, and performs mean-pooling to output a dense floating-point vector with a fixed dimension of 768 to represent the actual parameter semantics of the application interface call. Simultaneously, the system reads the expected semantic vector of the corresponding baseline node pre-generated when constructing the expected tool call graph and calculates the cosine similarity between the actual semantic vector and the expected semantic vector. When the cosine similarity is lower than the preset semantic similarity threshold in the system configuration file, the system determines the fourth bias.

[0033] After determining the existence of each deviation, the system calculates the target deviation value according to the deviation components corresponding to each determined deviation and a preset weight. In this embodiment, the target deviation value is represented by the single-step deviation corresponding to the t-th tool call request, and the single-step deviation is calculated based on the graph structure incremental cost and path semantic deviation. The system executes the following formula to calculate the single-step deviation corresponding to the t-th tool call request: ; In the above formula for calculating single-step deviation, the definitions and physical meanings of the variables include: This indicates the invocation sequence step number of the current tool invocation request within the current session; Indicates the first The target deviation value calculated step by step, i.e., the single-step deviation value; Indicates the first The cost of graph editing distance structure increment caused by step tool call is determined based on the existence of the first deviation, the second deviation and the third deviation, and the accumulated structure penalty score; Indicates the first The path semantic deviation value generated by the step tool call is calculated by subtracting the cosine similarity between the actual semantic vector and the expected semantic vector from the scalar value 1; This represents the system's preset graph structure deviation weighting coefficient, used to adjust the proportion of contribution of topology errors to the total deviation; This represents the system's preset semantic deviation weighting coefficient, used to adjust the proportion of contribution of parameter content offset to the total deviation; Indicates the first The pollution penalty factor applied in this step has a default value of 1, which can be dynamically adjusted to a value greater than 1 when a specific safety anomaly is detected. In this embodiment, the graph structure deviation weight coefficient... The value is 0.6, which is the semantic bias weighting coefficient. The value is 0.4; historical decay factor. The value is 0.9. This is the contamination penalty factor when the chain mutation detection module does not detect any anomalies. Maintain the default value of 1.0; when any of the aforementioned abnormal behaviors are detected, The chain mutation detection module is invoked to adjust the contamination penalty factor to the preset penalty value of 10.0, so that the calculated target deviation value reaches the corresponding access control threshold.

[0034] The accumulation of the structural penalty scores follows a preset mapping relationship: A penalty score of 1.0 is calculated for node insertion or deletion operations in the first deviation; a penalty score of 1.5 is calculated for node replacement operations; a penalty score of 1.0 is calculated for edge insertion or deletion operations in the second deviation; a penalty score of 2.0 is calculated for edge reversal operations; and a penalty score of 3.0 is calculated for the third deviation. If a single-step operation triggers multiple editing operations, the corresponding penalty scores are added together to obtain the final graph editing distance structural increment cost. .

[0035] Furthermore, the system performs state tracking of consecutive calls and calculates the cumulative deviation for the current session. The system executes the following formula to calculate the cumulative deviation: ; In the above formula for calculating cumulative deviation, the definitions and physical meanings of the variables include: Indicates as of the date The cumulative deviation value calculated step by step; This represents the historical cumulative deviation value calculated and stored in a register or cache in the previous timing step, for the initial state of the session. When it is 1, set The initial value is 0; This represents the system's preset historical decay factor, which ranges from 0 to 1. It is used to gradually decay small deviations generated in the early stages as the session execution depth increases, avoiding the continuous increase of cumulative deviations due to the growth of the session lifecycle. In this embodiment, the historical decay factor is set to 0.9. This indicates the first step deviation calculated using the aforementioned single-step deviation formula. Single-step deviation value.

[0036] like Figure 3As shown, the system performs access control processing on the current tool call request based on the target deviation value. Specifically, the system pre-configures multi-level judgment thresholds in the access control decision center, including a first single-step deviation threshold, a second single-step deviation threshold, and a third single-step deviation threshold. The third single-step deviation threshold is greater than the second single-step deviation threshold, and the second single-step deviation threshold is greater than the first single-step deviation threshold. The single-step deviation thresholds at each level are determined based on security baseline traffic statistics; under normal business testing conditions, the system collects the call trajectory of intelligent agents without malicious injection to establish a baseline confidence interval. Preferably, the first single-step deviation threshold is set to 0.3, corresponding to the boundary of slight parameter perturbation and normal topology; the second single-step deviation threshold is set to 0.8, corresponding to the boundary where single-node replacement or semantic edge shift may occur; and the third single-step deviation threshold is set to 2.0, corresponding to the boundary where forced blocking processing is required.

[0037] The system compares the calculated target deviation value with each level of threshold. If the target deviation value is less than the first single-step deviation threshold, the system sends an execution command to the tool's interception proxy layer, causing the proxy layer to forward the network data packet to the corresponding external tool service cluster for execution.

[0038] If the target deviation value is greater than or equal to the first single-step deviation threshold and less than the second single-step deviation threshold, the system calls the operating system's process scheduling interface to suspend the currently running execution thread of the agent and freezes the resource access permissions held by the agent through the access control list controller. Simultaneously, the system generates an audit log package containing the call context, the expected tool call graph, and the comparison results of the actual tool call graph, and sends it to the manual review interface to trigger manual intervention for confirmation. The agent's execution thread remains blocked until it receives a pass or deny instruction from the manual review interface.

[0039] If the target deviation value is greater than or equal to the second single-step deviation threshold and less than the third single-step deviation threshold, the system rejects the current tool call request but does not terminate the current session. Instead, it returns an exception code through the interface, instructing the agent to roll back to the previous safe node and replan the current task path.

[0040] If the target deviation value is greater than or equal to the third single-step deviation threshold, the system locally discards the data packet of the current tool call request, rejects the request, destroys the current session context of the agent, terminates the relevant process, and sends a security alarm record containing the event sequence to the security monitoring center.

[0041] Furthermore, in the method of this embodiment, in order to prevent untrusted external data from causing unintended guidance to the control flow of the intelligent agent, such as... Figure 4As shown, the system introduces a tainted data marking and call chain mutation detection mechanism in the data return path. Specifically, after the current tool call request is deemed safe, allowed, and the external tool completes execution, the proxy layer intercepts the data stream returned by the tool call. The system checks the source identifier of the returned data. If the obtained tool call return data comes from a pre-marked untrusted data source in the system, such as a third-party open interface outside the local area network, the system attaches a hardware or software-level data taint mark to the tool call return data, defining it as tainted data. The tainted data propagates downstream along the directed edges of the data stream in the memory structure of the actual tool call graph.

[0042] During the subsequent execution of the current session, the system monitors the agent's input stream. If tool call return data marked as tainted data enters the context of the current session, the system activates the call chain mutation detection module for that session. The detection range of the call chain mutation detection module is limited to a continuous call interval after the tainted data enters the context; this interval is defined as the effective window. Within the effective window, the system independently performs call chain mutation detection for each new tool call request.

[0043] The call chain mutation detection includes five specific detection rules to determine whether the agent's behavior has mutated due to tainted data. The system performs the following checks in sequence: detecting the presence of abnormal node insertion behavior, i.e., determining whether the tool specified in the current tool call request is completely absent from the node set of the expected tool call graph; detecting the presence of order reversal behavior, i.e., determining whether the actual call order violates the directed edge temporal direction specified in the expected tool call graph, resulting in topological reversal; detecting the presence of skipping levels behavior, i.e., determining whether a request is made directly to a deeper topological node without executing a necessary node within the current topological level; and detecting the presence of parameter semantic jump behavior, i.e., maintaining a sliding window (e.g., the window length is the last 50 calls) in the current session, calculating and recording the average value of the historical call parameter semantic similarity of the node in real time. with standard deviation When the cosine similarity value of the parameters in this call is lower than 0. When the baseline for detecting three times the standard difference is triggered, it is determined that the deviation from the historical distribution has occurred and the parameter semantic jump behavior has occurred; it is also detected whether there is a behavior of exceeding the limit of the cumulative number of repeated calls, that is, whether the actual number of consecutive calls to the same tool identifier exceeds the maximum number of repeated calls configured for it in the expected tool call graph.

[0044] If the call chain mutation detection module detects at least one of the above five behaviors within the effective window, the system determines that the control flow is abnormally guided by tainted data, and adjusts the pollution penalty factor used in calculating single-step deviation from the default value to a preset penalty value greater than the default value, in order to weight the target deviation value corresponding to the tool call request appearing within the effective window. The weighted target deviation value is used to compare with the single-step deviation thresholds at each level, so that the access control module performs the corresponding control processing according to the corresponding threshold range.

[0045] Furthermore, to implement the principle of least privilege at fine-grained time slices and prevent abuse of permissions, the system integrates a topological sorting and stage-based dynamic authorization mechanism based on directed acyclic graphs (DAGs) into the execution flow of the method. Specifically, after constructing the expected tool call graph, the system executes a topological sorting algorithm. The topological sorting algorithm traverses the set of nodes and directed edges in the expected tool call graph, calculating the in-degree value of each node. The system assigns nodes with an in-degree of zero to the same topological layer, then virtually removes these nodes and their emanating directed edges from the graph structure, and updates the in-degree values ​​of the remaining nodes. The system repeats the above in-degree calculation and removal process until all nodes are assigned to a specific topological layer. Based on the topological sorting results, the system divides the nodes in the expected tool call graph into multiple stages. Each stage strictly corresponds to at least one node in the same topological layer of the expected tool call graph. Nodes in the same stage have no logical sequential dependency.

[0046] At the moment the agent initiates initialization for the current task, the system intercepts the default full authorization operation of the underlying resource access controller. The system queries the topology sorting results and locates the initial stage (i.e., the first topology layer). The system extracts the minimum permission set bound to the node corresponding to the initial stage. The system generates and issues an access token containing only the minimum permission set of the initial stage to the agent. Through this step, in the initial state, the agent is only granted permissions to execute the minimum permission set bound to the node corresponding to the initial stage, ensuring that the agent cannot access any sensitive resources in subsequent stages at the beginning of the task.

[0047] During the current session, the system performs state machine polling. The state machine listens for the execution status codes of each node returned by the proxy layer. In response to the state machine confirming that all nodes with the required attributes in the current stage have received a return status code, signifying completion, and that the system's internal counter shows that the cumulative number of calls to each node in the current stage has not exceeded the corresponding maximum number of repeated calls, the system triggers a permission transition process. In this process, the system locates the next stage based on the topology sorting result and extracts the minimum permission set bound to the nodes corresponding to the next stage. The system sends an update command to the access control list manager, updating the access token permissions held by the agent from the minimum permission set corresponding to the current stage to the minimum permission set corresponding to the next stage. Within the same instruction cycle when the new access token takes effect, the system forcibly executes garbage collection and handle deregistration procedures, reclaiming the permissions of the current stage. This mechanism ensures that the agent only holds the resource access credentials necessary to complete the current local operation at any given time, cutting off the technical channel for unintended backdoor operations using residual permissions.

[0048] To further illustrate the specific implementation of this application's embodiments, a system operation scenario is given below. Assume an intelligent business processing system is deployed in a data center, and a user interface receives a command text. The system extracts the earliest timestamp of the user input, confirms that its source identifier corresponds to a trusted terminal, and obtains the original true intent text. The natural language processing module parses the text into a sequence containing three atomic subtasks and determines the task boundaries. The system constructs a projected tool call graph based on pre-stored tool capability snapshots. This graph includes nodes A, B, and C, with directed edges pointing from A to B and from B to C. Node A is bound to minimum read-only permission and marked as a mandatory attribute; node B is bound to data filtering operation permission and marked as an optional attribute; and node C is bound to specified path write permission and marked as a mandatory attribute. The system performs topological sorting, dividing nodes A, B, and C into a first stage, a second stage, and a third stage, respectively. When the agent starts, the system only issues read-only permission to node A. After the agent issues a call request for the tool corresponding to node A, the proxy layer intercepts the request and generates the first node of the actual tool call graph. The system determines the deviation type and calculates the target deviation value based on the baseline cursor set. Since node A belongs to the baseline cursor set, the graph editing distance structure increment cost is zero and the semantic similarity meets the threshold requirement. The target deviation value is less than the first single-step deviation threshold, and the system allows the request. Subsequently, the execution result of node A is returned by an untrusted third-party database, and the system marks this returned data as tainted data. After receiving the tainted data, the agent initiates a call request for the tool corresponding to node C. Since node B is an optional node, the baseline cursor set can include node C. At the same time, the call chain mutation detection module detects that the cosine similarity between the call parameters and expected parameters of node C is lower than the preset threshold within the effective window of the tainted data, determining that a parameter semantic jump has occurred. The system adjusts the taint penalty factor from the default value to the preset penalty value and substitutes it into the single-step deviation calculation formula for weighted calculation. If the calculated target deviation value is greater than or equal to the third single-step deviation threshold, the system discards the request data packet and terminates the relevant process, thereby completing the abnormal access interception.

[0049] Based on the same technical concept as the aforementioned method embodiments, this application also provides an access control device for intelligent agents. For example... Figure 5 As shown, the device is applied to an intelligent business processing system. The device includes an acquisition module, a task boundary determination module, a anticipated tool call graph construction module, an actual tool call graph generation module, a target deviation determination module, and an access control module.

[0050] The acquisition module is configured to perform data stream monitoring and filtering operations to acquire the current session between the user and the agent, and to identify the user's original true intent text at the start of the current session. The acquisition module has an input buffer and a source identifier parser, which can separate the request data packets reported by the user terminal from other asynchronous system callback data packets, ensuring that the extracted text data is not contaminated by external systems at the physical transmission channel level.

[0051] The task boundary determination module and the acquisition module establish a data connection via an internal bus to perform semantic parsing on the original true intent text and identify the task boundary corresponding to the original true intent text. This module embeds a lexical analysis engine and an entity relation extraction model, and its output port generates a standardized resource access restriction parameter dictionary and an operation action whitelist to define the execution scope of the task.

[0052] The expected tool call graph construction module is coupled with the task boundary determination module and is used to construct the expected tool call graph based on the task boundary. The expected tool call graph construction module is configured with a data structure generator. In the generated data structure, nodes represent pre-called tools, directed edges represent the call order, each node is bound to a minimum permission set, and is labeled with mandatory or optional attributes and the maximum number of repeated calls. This module has a validator interface, used to retrieve and compare the hash verification value of a pre-stored read-only tool capability snapshot in real time during the graph generation stage, ensuring the reliability of the generated baseline.

[0053] The actual tool call graph generation module is independent of the large model inference framework and is deployed on top of the transmission control protocol layer of the network protocol stack. It is used to intercept the current tool call requests issued by the agent during runtime. When the module receives a request, it pauses the routing and forwarding of data packets, combines the actual calling tools in all previously allowed tool call requests and the actual calling order among the actual calling tools, allocates a memory area in the system heap memory, and generates a linked list representation or matrix representation of the actual tool call graph.

[0054] The target deviation determination module is used to determine the target deviation by comparing the actual tool call graph with the expected tool call graph based on a pre-maintained baseline cursor set. The target deviation includes a deviation type and a target deviation value; the deviation type includes at least one of a first deviation, a second deviation, a third deviation, and a fourth deviation; the target deviation value is calculated by weighting the deviation components corresponding to each determined deviation according to a preset weight. The baseline cursor set is stored in a cache area and is used to indicate the candidate tool nodes allowed to be called at the current execution progress. If the tool node corresponding to the current tool call request does not belong to the baseline cursor set, and the tool node is located at the successor level of a node that has not yet been completed and has the required path attribute, then the target deviation determination module determines the third deviation, i.e., the required path node skip deviation. The target deviation determination module also includes a vector operation unit for calculating cosine similarity and a graph matching unit for calculating graph edit distance.

[0055] The access control module receives the target deviation value output by the target deviation determination module and performs access control processing on the current tool call request based on the target deviation value. The access control module is connected to the operating system's process scheduling interface and the network firewall's policy configuration interface, and generates an allow signal, a thread suspension interruption signal, a request denial signal, or a network connection reset signal according to a set threshold range.

[0056] Furthermore, embodiments of this application provide an electronic device. For example... Figure 6 As shown, the electronic device includes a memory, a processor, and an external network interface connected via a communication bus. The memory stores computer programs for implementing the functions of the aforementioned modules. The processor may be a central processing unit, a digital signal processor, a graphics processing unit, or a field-programmable gate array (FPGA). When the processor reads and executes the computer program, it implements the agent-oriented access control method described in the foregoing embodiments.

[0057] Furthermore, this application provides a computer-readable storage medium. The computer-readable storage medium may be a non-volatile or volatile physical medium such as a read-only memory, random access memory, electrically erasable programmable read-only memory, flash memory, or magnetic hard disk drive. The physical sectors or storage units of the computer-readable storage medium store a sequence of binary code for a computer program. When the sequence of binary code for the computer program is read into the processor of an electronic device and executed, all specific operations and steps of the agent-oriented access control method described in the foregoing embodiments are implemented.

[0058] It should be understood that the modules and algorithm steps described in the embodiments of this application can be implemented by hardware, software, or a combination of hardware and software. For the parts implemented in software, the corresponding functions can be stored as computer programs in a computer-readable storage medium and executed by a processor; for the parts implemented in hardware, dedicated circuits, programmable logic devices, or other hardware structures capable of implementing the corresponding functions can be used. Those skilled in the art can choose the appropriate implementation method according to the specific application scenario. The terms "comprising," "including," or "having" used herein are used to indicate a non-exclusive inclusion relationship.

[0059] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. An access control method for intelligent agents, characterized in that, Applications in intelligent business processing systems include: Obtain the current session between the user and the agent, and identify the user's original true intent text at the start of the current session; Semantic parsing is performed on the original true intent text to identify the task boundary corresponding to the original true intent text; Based on the task boundary, a expected tool call graph is constructed. Nodes in the expected tool call graph represent tools to be called, directed edges represent the call order, each node is bound to a minimum set of permissions, and is labeled with a mandatory or optional attribute and a maximum number of repeated calls. The mandatory attribute is used to characterize that the corresponding task must rely on external tools for processing, and the optional attribute is used to characterize that the corresponding task can be completed by the agent's own context reasoning ability. Intercept the current tool call request issued by the agent during runtime, and combine the actual tools called in all the tool call requests that were allowed before this request, as well as the actual calling order between each actual tool, to generate an actual tool call graph in real time; Based on a pre-maintained set of baseline cursors, the actual tool call graph is compared with the expected tool call graph to determine the target deviation. The set of baseline cursors indicates candidate tool nodes that are allowed to be called under the current execution progress. If the tool node corresponding to the current tool call request does not belong to the set of baseline cursors, and the tool node corresponding to the current tool call request is located at the successor level of a node with the required path attribute that has not yet been completed in the set of baseline cursors, then the deviation type corresponding to the target deviation is determined to include a required path node skip deviation. Based on the target deviation, perform access control processing on the current tool call request.

2. The method according to claim 1, characterized in that, The step of comparing the actual tool call graph with the expected tool call graph to determine the target deviation also includes: If the actual tool call graph contains a target node that does not belong to the expected tool call graph, lacks an expected node in the expected tool call graph, or the actual node's tool type is inconsistent with the corresponding expected node, then a first deviation is determined. If the actual calling order of each node in the actual tool calling graph violates the direction of the directed edges between corresponding nodes in the expected tool calling graph, then a second deviation is determined; If the actual tool call graph skips a node with the required attribute that has not yet been completed in the expected tool call graph, then a third deviation is determined, which is the skip deviation of the required node; For each node in the actual tool call graph, if the semantic similarity between the call parameters of the node and the expected semantics of the corresponding node in the expected tool call graph is lower than a preset similarity threshold, then a fourth deviation is determined. The target deviation includes a deviation type and a target deviation value. The deviation type includes at least one of the first deviation, the second deviation, the third deviation, and the fourth deviation. The target deviation value is obtained by weighting the deviation components corresponding to the determined deviations according to preset weights.

3. The method according to claim 2, characterized in that, Determining the first deviation and the second deviation includes: The graph edit distance algorithm is used to calculate the sequence of editing operations required to transform the actual tool call graph into the expected tool call graph. The sequence of editing operations includes at least one of node insertion, node replacement, node deletion, edge insertion, edge deletion, and edge reversal. If the sequence of edit operations includes the node insertion operation, the node replacement operation, or the node deletion operation, then the first deviation is determined; If the editing operation sequence includes the edge insertion operation, the edge deletion operation, or the edge reversal operation, then the second deviation is determined.

4. The method according to claim 1, characterized in that, After performing access control processing on the current tool invocation request based on the target deviation, the method further includes a baseline cursor dynamic update step, specifically including: After the current tool call request is approved and the corresponding node has been executed, the direct successor node of the node in the expected tool call graph is added to the baseline cursor set. If a node with the optional attribute exists among the direct successor nodes, a recursive search is performed along the topological successor direction of the node with the optional attribute, and the found topological successor node is simultaneously included in the baseline cursor set.

5. The method according to any one of claims 1 to 4, characterized in that, The step of performing access control processing on the current tool invocation request based on the target deviation includes: If the target deviation value is less than the preset first single-step deviation threshold, then the current tool call request is allowed; If the target deviation value is greater than or equal to the first single-step deviation threshold and less than the preset second single-step deviation threshold, then the execution thread of the agent is suspended, the permissions of the agent are frozen, and manual intervention confirmation is triggered. If the target deviation value is greater than or equal to the second single-step deviation threshold and less than the preset third single-step deviation threshold, the current tool call request is rejected, and the agent is instructed to roll back to replan the call path. If the target deviation value is greater than or equal to the preset third single-step deviation threshold, the current tool call request is directly rejected, an alarm is issued, and the context of the current session is destroyed; the third single-step deviation threshold is greater than the second single-step deviation threshold, and the second single-step deviation threshold is greater than the first single-step deviation threshold.

6. The method according to any one of claims 1 to 4, characterized in that, After performing access control processing on the current tool call request based on the target deviation, the method further includes tainted data marking and call chain mutation detection steps, specifically including: After the current tool call request is allowed and executed, if the returned data from the tool call comes from an untrusted data source, the returned data is marked as tainted data. In the current session, if tool call return data marked as tainted data enters the context of the current session, then for tool call requests that appear within the effective window after entering the context, call chain mutation detection is performed; If a call chain mutation is detected, the target deviation value corresponding to the tool call request appearing within the effective window is weighted with a penalty factor greater than the default value; The call chain mutation detection includes detecting at least one of the following: insertion of abnormal nodes, order reversal, skipping steps, parameter semantic jumps, and the cumulative number of repeated calls to the same node exceeding the corresponding maximum number of repeated calls.

7. The method according to any one of claims 1 to 4, characterized in that, After constructing the expected tool call graph, the method further includes a phased dynamic authorization step based on graph topology sorting, specifically including: The expected tool call graph is topologically sorted, and the nodes in the expected tool call graph are divided into multiple stages, with each stage corresponding to at least one node in the same topological layer of the expected tool call graph; When the agent starts, it is granted only the permissions from the minimum permission set bound to the node corresponding to the initial stage of execution. During the operation of the current session, in response to the fact that all nodes with the required attributes in the current stage have been executed and the cumulative number of calls of each node in the current stage has not exceeded the corresponding maximum number of repeated calls, the agent's permissions are updated from the minimum permission set corresponding to the current stage to the minimum permission set corresponding to the next stage, and the permissions of the current stage are revoked.

8. An access control device for intelligent agents, characterized in that, Applications in intelligent business processing systems include: The acquisition module is used to acquire the current session between the user and the intelligent agent, and to identify the user's original true intent text at the start of the current session; The task boundary determination module is used to perform semantic parsing on the original true intent text and identify the task boundary corresponding to the original true intent text. The expected tool call graph construction module is used to construct an expected tool call graph based on the task boundary. Nodes in the expected tool call graph represent pre-called tools, directed edges represent the call order, each node is bound to a minimum set of permissions, and is labeled with a mandatory or optional attribute and a maximum number of repeated calls. The mandatory attribute is used to characterize that the corresponding task must rely on external tools for processing, and the optional attribute is used to characterize that the corresponding task can be completed by the agent's own context reasoning ability. The actual tool call graph generation module is used to intercept the current tool call request issued by the agent at runtime, and generate an actual tool call graph in real time by combining the actual calling tools in all the tool call requests that were allowed before this request and the actual calling order between each actual calling tool. The target deviation determination module is used to determine the target deviation by comparing the actual tool call graph with the expected tool call graph based on a pre-maintained baseline cursor set. The baseline cursor set indicates candidate tool nodes that are allowed to be called under the current execution progress. If the tool node corresponding to the current tool call request does not belong to the baseline cursor set, and the tool node corresponding to the current tool call request is located at the successor level of a node with the mandatory attribute that has not yet been completed in the baseline cursor set, then the deviation type corresponding to the target deviation is determined to include mandatory node skip deviation. The access control module is used to perform access control processing on the current tool call request based on the target deviation.

9. An electronic device, characterized in that, It includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images