paperJuly 2026Unreviewed

aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents

Sai Varun Kodathala

Abstract

AI agents issue tool calls on the basis of text they cannot verify, so any party who controls part of the context can forge the appearance of authority. I evaluate 15 contemporary language models against eight attack scenarios derived from a published corpus of real agent incidents and find that refusal varies from 100% down to 38% across fully evaluated models; the most expensive model refused only half of the attacks despite a twentyfold price spread. I present aiAuthZ, an authorization gatewa

Cite

@misc{kodathala2026aiauthz,
  title = {{aiAuthZ: Off-Host, Identity-Bound Authorization for AI Agents}},
  author = {Sai Varun Kodathala},
  year = {2026},
  month = jul,
  eprint = {2607.05518},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2607.05518}
}