Authority After Prompt Injection: Pre-Results Study Protocol and Reproducibility Harness for Tool-Using LLM Agents

Abstract

This record documents a pre-results, pre-freeze public study protocol and reproducibility harness for an empirical study of tool-using large-language-model agents under prompt-injection exposure and externally narrowed authority. The artifact specifies the threat model, authority narrowing and evidence-gated restoration rules, primary harness-record metrics, a fixed tools-disabled self-report probe, experiment-matrix structure, statistical analysis plan, local invariant tests, and reproducibility gates. It contains no empirical LLM performance results. At the time of this public snapshot, no provider-backed model run, paid pilot, or confirmatory experiment had been executed for the study, and the final confirmatory protocol freeze had not yet occurred. Local unit and invariant tests are software checks only and are not agent-performance findings. AgentDojo, CaMeL, provider SDKs, benchmark attack payloads, the development smoke-policy corpus, and confirmatory task policies are not redistributed; third-party dependencies must be obtained from their official sources. The purpose of this record is to preserve a timestamped public pre-freeze specification against which later protocol-freeze and empirical releases can be audited.