ML Security PapersAuthenticated Workflows: A Systems Approach to Protecting Agentic AI
Mohan Rajagopalan 1, Vinay Rao 2
Published on arXiv
2602.10465
Prompt Injection
OWASP LLM Top 10 — LLM01
Insecure Plugin Design
OWASP LLM Top 10 — LLM07
Excessive Agency
OWASP LLM Top 10 — LLM08
Key Finding
Achieves 100% recall with zero false positives across 174 test cases and protects against 9 of 10 OWASP LLM Top 10 risks with complete mitigation of two high-impact production CVEs.
Authenticated Workflows / MAPL
Novel technique introduced
Agentic AI systems automate enterprise workflows but existing defenses--guardrails, semantic filters--are probabilistic and routinely bypassed. We introduce authenticated workflows, the first complete trust layer for enterprise agentic AI. Security reduces to protecting four fundamental boundaries: prompts, tools, data, and context. We enforce intent (operations satisfy organizational policies) and integrity (operations are cryptographically authentic) at every boundary crossing, combining cryptographic elimination of attack classes with runtime policy enforcement. This delivers deterministic security--operations either carry valid cryptographic proof or are rejected. We introduce MAPL, an AI-native policy language that expresses agentic constraints dynamically as agents evolve and invocation context changes, scaling as O(log M + N) policies versus O(M x N) rules through hierarchical composition with cryptographic attestations for workflow dependencies. We prove practicality through a universal security runtime integrating nine leading frameworks (MCP, A2A, OpenAI, Claude, LangChain, CrewAI, AutoGen, LlamaIndex, Haystack) through thin adapters requiring zero protocol modifications. Formal proofs establish completeness and soundness. Empirical validation shows 100% recall with zero false positives across 174 test cases, protection against 9 of 10 OWASP Top 10 risks, and complete mitigation of two high impact production CVEs.
Key Contributions
- Authenticated workflows: a deterministic trust layer combining cryptographic proof of intent and integrity at four boundary types (prompts, tools, data, context) for enterprise agentic AI.
- MAPL, an AI-native hierarchical policy language for agentic constraints that scales as O(log M + N) versus O(M×N) for traditional rule systems.
- Universal security runtime with thin adapters for nine leading agent frameworks (MCP, A2A, OpenAI, Claude, LangChain, CrewAI, AutoGen, LlamaIndex, Haystack) requiring zero protocol modifications.