Agentic Permissions Policy Algebra for Taint Confinement in LLM Agents

APPA: Agentic Permissions Policy Algebra for taint confinement in LLM agents

Researchers introduce APPA (Agentic Permissions Policy Algebra), an Information Flow Control framework designed to prevent prompt injection and data exfiltration in autonomous LLM agents processing mixed-confidentiality data. The key innovation is engine-managed context branching: rather than permanently tainting an agent's context when it reads unvetted data, APPA spawns isolated child trajectories that absorb label descent locally, allowing a sanitizer to return a bounded derivative to the clean parent context. Evaluated on a multi-turn tool-chaining benchmark across four models, APPA reduces exfiltration attack success from 31–50% down to 0–7% while recovering substantial utility lost by naive taint tracking. The framework is grounded in a formal two-monoid model with proofs of parent label preservation and merge confinement.