Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals

arXiv·high signal

A new arXiv paper tackles a live production problem: as autonomous LLM agents hold real credentials and operate infrastructure without a human in the loop, operators have no standard way to tell an agent 'you are not authorized for this' and trust it to stop. It introduces a measurement framework for whether agents honor in-band access-deny signals rather than retrying, escalating, or routing around the denial. Directly relevant to anyone running agents with write access to systems — graceful recusal is becoming a required safety primitive.