Autonomous LLM agents act through tools, and a common safety mechanism is per-action authorization: a local guard screens each tool call in isolation. A new arXiv paper (2610.27620) argues that this approach is fundamentally insufficient.
The core claim is that local authorization does not compose into global authorization. Even if every individual action passes a local check, the sequence of actions as a whole can violate the intended policy. This is a compositional failure, not a matter of tuning individual guards.
The abstract points toward a compositional authorization framework as the alternative, though the provided excerpt does not give specifics. The significance is clear: safety for LLM agents must be evaluated at the level of the entire trajectory, not just one call at a time.