Before the Tool Call (arXiv:2603.20953)

Before the Tool Call: Deterministic Pre-Action Authorization for Autonomous AI Agents. Uchi Uchibeke, arXiv:2603.20953, submitted 21 March 2026. DOI 10.48550/arXiv.2603.20953.

What it argues

An agent selects its next action probabilistically. Some actions are not probabilistic: moving money, dropping a table, running a shell command, sending mail to a list. The paper puts a deterministic authorization decision between the model's choice and the call, at the before_tool_call boundary of the agent framework rather than inside the model, and shows that a prompt injection cannot reason its way past a check that is not reading the prompt.

The decision terminates in allow, deny, or escalate to a human. Same inputs, same answer, no sampling and no temperature. The paper proposes the pattern as a control category mapped to the NIST AI Risk Management Framework.

The evidence in it

From a public adversarial testbed with a $5,000 bounty: 3,900+ authorization decisions across 1,100+ sessions, over half denied. Attackers talked the model past its instructions over 70 percent of the time against a permissive policy and 0 percent of the time against a restrictive one, across 800+ attempts. Nobody claimed the bounty. Median decision latency was 53ms, p95 63ms, p99 76ms over 1,000 requests.

The model was the same in both tiers. The policy engine did the work.

Read it

Cite it

@misc{uchibeke2026beforethetoolcall,
  title  = {Before the Tool Call: Deterministic Pre-Action Authorization
            for Autonomous AI Agents},
  author = {Uchibeke, Uchi},
  year   = {2026},
  eprint = {2603.20953},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CR},
  doi    = {10.48550/arXiv.2603.20953}
}

Author identifiers: ORCID 0000-0003-2238-9267, Google Scholar, DBLP.

Background

The paper is the formal version of an argument I had been making publicly since August 2025, and the specification it describes is the Open Agent Passport. The term it introduces has a page of its own.