Securing Multi-Tool AI Agent Chains With Dynamic, Real-Time Compositional Policies

Abstract: Modern AI agent implementations such as frontier coding agents chain multiple tools at runtime that create a security surface that per-tool guardrails are unable to address, as individually permitted tools can violate organizational policies when composed. We propose the Dynamic Security Control Compositor (DSCC), a two-phase approach to compositional security for multi-tool agent chains. In Phase 1, at session checkout, a Most Restrictive Set (MRS) algorithm composes per-tool security policies into a single effective policy with a formal monotonicity invariant that extending a chain can only tighten the result, blocking incompatible combinations before any tool executes. Outputs of any tool call propagate their classification constraints into a session-level taint state, so subsequent invocations must satisfy the most restrictive constraints seen so far. In Phase 2, at runtime, the system tracks the sensitivity of data the agent touches through a monotonic taint state and revokes the session if the accumulated exposure would make a subsequent tool call a policy violation. Together, these phases provide defense in depth, where static composition prevents unsafe chains from starting, and runtime taint tracking catches violations that emerge from the specific data used. We provide a reference implementation on 32 tools governed by 16 NIST SP 800-53 aligned policies and evaluate it under two composition modes. In the default clearance mode, permitted combinations are partitioned into classification-level clusters, blocking 79.2% of policy pairs and 95.5% of triples. The alternative taint mode admits mixed-classification chains within the exfiltration boundary, blocking 42.5% and 60.5% respectively. We discuss the governance implications for organizations deploying multi-tool agents, including the utility-security tradeoff and the changes needed to operationalize chain-aware policies.

• The paper introduces DSCC, a dual-phase enforcement architecture that unifies per-tool security policies into a most restrictive composite, ensuring monotonicity in tool chains.
• It demonstrates that clearance mode blocks up to 95.5% of multi-tool policy violations while taint mode enables dynamic mixed-classification chaining with strict runtime controls.
• The approach offers measurable, auditable enforcement for robust agent oversight, significantly mitigating emerging compositional vulnerabilities in AI systems.

Securing Compositional AI Agent Tool Use via Dynamic, Real-Time Policy Composition

Introduction

LLM agents are increasingly capable of orchestrating sequences of tool invocations, including file access, code execution, API calls, and inter-agent communication. In production, such compound tool use exposes a novel security surface: while each tool invocation may be individually authorized, their arbitrary compositions enable emergent violations of organizational, regulatory, or security policy. Prior work demonstrates that the majority of discovered vulnerabilities in multi-tool agent environments manifest only through the interaction between tools rather than via single-tool misuse. Notably, weak per-tool guardrails are insufficient to protect against combined threats such as STAC-style multi-step attack chains or leakage across classification boundaries in agent workflows.

Dynamic Security Control Compositor: Architecture and Policy Model

The paper introduces the Dynamic Security Control Compositor (DSCC), a dual-phase enforcement architecture for compositional security over arbitrarily chained agent tool invocations. Each tool is annotated with a 6-tuple security policy, including control bindings, data-flow classification, transmission prohibitions, data-flow direction properties, permitted network zones, and maximum session TTL. These policy atoms are aligned with NIST SP 800-53 and form a standardized layer for compositional reasoning.

The core of DSCC is Phase 1's Most Restrictive Set (MRS) algorithm, which unifies per-tool policies for all tools in a candidate chain into a single effective policy. The MRS operator is strictly monotonic: with every addition to the chain, effective constraints can only tighten—never relax—thus ensuring that aggregate permissions are never weakened by composition.

Figure 1: Phase 1 composition under both modes—clearance mode allows only within-classification compositions, taint mode permits mixed-classification chains while strictly propagating and tracking taint.

The MRS executes the following steps:

1. Compatibility Check: Ensures structural satisfiability, excluding contradictory constraints.
2. Control Resolution: For each NIST control, computes the effective (most restrictive) level from all composed tools.
3. Data-flow Composition: Sets the session's high-water mark classification, applies the strictest data exfiltration restrictions, and restricts operation to the intersection of allowed network zones.
4. Deny Enforcement: Explicitly blocks flows violating any Deny-level constraint in the resultant set.

Two operational DSCC modes are defined:

• Clearance Mode: All tools in a chain must be pre-cleared for the highest classification of any resource they may touch; cross-classification tool chains are algorithmically blocked.
• Taint Mode: Mixed-classification chains are allowed, but the session maintains a mutable, monotonically increasing taint marking the peak data sensitivity encountered. This is enforced dynamically at each runtime invocation, blocking any step that would attempt data exfiltration or boundary violation with elevated taint.

Static and Runtime Enforcement: Evaluation and Results

DSCC’s dual-phase architecture combines per-chain static composition (Phase 1) with per-call runtime taint validation (Phase 2). Phase 1 blocks structurally non-compliant chains prior to any tool execution, significantly reducing the threat of compositional vulnerabilities.

Notably, in the reference evaluation over a catalog of 32 tools and 16 NIST-aligned policies:

• Clearance mode blocks 79.2% of policy pairs and 95.5% of triples. Permitted sets strictly cluster into single-classification cells; any cross-classification chains are algorithmically prohibited.
• Taint mode blocks 42.5% of pairs and 60.5% of triples, enabled by omission of the clearance check but strict propagation of session taint and exfiltration boundaries.

The permitted/blocked partitioning is visualized in Figure 1: under clearance, only within-level compositions are possible; under taint, a large mixed-classification block is permitted so long as the taint barrier is not violated. The block rate increases with chain length, consistent with the monotonicity guarantee. Importantly, enforcement is tractable and auditable: for any session, DSCC delivers a single effective composite policy.

At runtime, DSCC tracks the session taint with every resource access, using per-resource classification labels. Three examples demonstrate system behavior:

• Benign Workflow: Agent accesses only public or shareable resources and completes its chain without taint elevation or session revocation.
• Partial Block: After touching confidential data with a transmission prohibition, attempts at further data exfiltration (e.g., cloud upload) trigger session revocation consistent with policy constraints.
• Immediate Block: Accessing a restricted/legal resource immediately taints the session; any subsequent attempt to use an outbound tool (e.g., external API) is blocked.

Theoretical Guarantees and Compositional Soundness

A key property underlying DSCC is monotonicity: as tool chains are extended, the effective control set can only become more restrictive for all policy dimensions—classification, control action, network zones, transmission prohibitions, and session duration. This ensures that no sequence of agent-selected tools can circumvent security policy via chain composition. The architecture eliminates trusted subject exemptions and applies end-to-end data labeling and control for robust enforcement against both intentional and unintentional policy circumvention.

Practical and Organizational Implications

Implementing DSCC induces a utility-security tradeoff: fine-grained policy enables broad compositional flexibility, but coarse or misaligned classification leads to high block rates (potential overrestriction). However, all overblocks are recoverable via policy refinement, while underblocks may result in unrecoverable compromise. DSCC’s design facilitates measurable, auditable policy enforcement with minimal operational ambiguity and powerful incident attribution, supporting robust governance and ongoing lifecycle management of tool policies.

Crucially, DSCC aligns with emerging risk mitigation strategies in frontier-agent oversight, providing a control-layer backstop orthogonal to capability-level evaluations. As multi-agent, cross-ecosystem, and autonomous workflows proliferate, DSCC guarantees that policy violations—whether arising from unforeseen tool combinations, agent misalignment, or advanced adversarial input—can be preemptively blocked or immediately remediated at runtime. The architecture can be configured for always-on or risk-threshold-triggered deployment, supporting both default-enforcement and capability-triggered escalation postures.

Conclusion

This work formalizes, implements, and evaluates compositional policy enforcement for multi-tool AI agent chains. The DSCC architecture statically and dynamically bounds aggregate action permission, blocking policy-violating chains both pre-execution and at runtime via monotonic taint tracking. Empirical results validate substantial attack surface reduction in both operational modes. The compositional architecture is suitable for operationalization in environments subject to regulatory or organizational constraint, and constitutes a robust mitigation layer for agentic frontier risk management. Future avenues include expanding the policy model beyond NIST alignment and automating policy authoring based on programmatic or LLM-derived tool characterization.