Semantic Privilege Collapse: Trust Boundaries and Execution-Level Authorization in Agentic AI Systems

Abstract

Large language model agents operating within tool-enabled pipelines create opportunities for untrusted content to influence consequential actions. This note introduces semantic privilege collapse as an architectural failure condition in which task data or insufficiently authorized instructions are promoted into effective action authority through model interpretation. The term does not claim discovery of a wholly new vulnerability: it synthesizes the confused-deputy problem, prompt-injection risks, capability-oriented control, and modern agentic authorization requirements. Drawing on OWASP’s 2025 LLM Top 10, OWASP agent-security guidance, Policy in Amazon Bedrock AgentCore, Simon Willison’s Dual LLM pattern, and Google DeepMind’s CaMeL research, the note distinguishes behavioral resistance to prompt injection from independently enforced execution authorization. It further distinguishes a principal’s standing permissions from task-specific authority and action-specific approval. The central argument is that semantic interpretation is not authorization evidence: protected operations require complete mediation through controls that validate identity, scope, policy, and required approvals independently of model-generated assertions. The analysis recognizes that malicious actions can remain policy-permitted when enforced policies are broader than the intended task. A reference security stack, properties of effective execution authorization, and proposed evaluation criteria are held in a restricted companion edition.