Preprint tests authorization broker for compromised LLM agents

A preprint describes an authorization broker intended to confine LLM agents and their sub-agents to explicitly delegated actions. The authors report that a default bearer-credential runtime failed four modeled threats, while their broker blocked those threats in adversarial testing. They report zero accepted forged tokens in 200,000 attempts and a mean of 1.5 reachable actions for a compromised sub-agent, compared with all 8,100 under bearer delegation. The work remains a preprint, and its reported results have not been independently verified.