CapAgent: Semantic Data-Flow Governance for LLM Agents in Big-Data Cognitive Computing

Abstract

Large language model (LLM) agents are becoming cognitive interfaces to data lakes, enterprise knowledge bases, vector memories, browsers, files, and software tools. This shift creates a data-governance gap: an agent may reason over large private context, yet the protected resource often lacks a verifiable record of which user intent, data object, action, destination, and semantic release were authorized. This paper proposes CapAgent, a semantic data-flow governance middleware for LLM agents in big-data cognitive-computing environments. CapAgent maps human-attested task intent into signed, attenuable, and purpose-bound capability tokens that are checked by a reference monitor before sensitive tool invocation, memory retrieval, data export, and inter-agent delegation. Its policy layer combines task templates, resource labels, destination rules, caveats, semantic release modes, and audit obligations; its runtime enforces both symbolic scope checks and semantic recoverability checks over protected facts. We present formal governance semantics, a conservative intent compiler, an explainable data-flow decision workflow, and a runnable Python middleware. A reproducible trace-replay benchmark with 600 benign and adversarial traces across five data-intensive agent scenarios reports attack success, benign success, false blocking, latency, component ablations, and audit quality. In this synthetic trace-replay evaluation, the full monitor reduces measured attack success from 100.00% under ambient execution and 12.50% under scope-only authorization to 0.00% (Wilson 95% CI [0.00, 0.95]), while retaining 75.00% benign success. In addition, we conduct a 520-trial end-to-end tool-calling benchmark with representative prompt-only, task-shield-style, CaMeL-style, scope-only, and full-CapAgent configurations; a 210-task compiler gold-standard evaluation; a 240-item semantic-release calibration set; and a 12-cell BDCC-style scalability microbenchmark. In these supplemental tests, full CapAgent obtains 0.00% ASR (95% CI [0.00, 1.06]) in the tool-calling benchmark, 87.50% exact-policy compiler match with 0.00% over-authorization, 88.89% semantic-release recall with 0.00% false-block rate, and sub-millisecond in-process authorization latency up to 100,000 resources. The results support CapAgent as an auditable governance layer for cognitive LLM agents rather than as a replacement for model-level alignment or public end-to-end agent benchmarks.