Instruction Self-Arbitration Is Not a Trust Boundary: Configuration-Dependent Tool Calls and External Enforcement in LLM Agents

Abstract

LLM agents receive instructions from system prompts, users, memory and tools, and labels inside a shared context are not an enforceable trust boundary. We study how measurement and configuration choices change what benign file-deletion tasks on gateway-labelled endpoints appear to show (an availability-selected roster) and test an external reference monitor. The original keyword flag for detecting fabricated authority mostly matched negated phrases: two blind judges flagged the claim as fabricated in at most 1 of 150 GPT-4.1-mini responses. In a fully logged reflection re-run, responses that both express doubt and delete are rare after a reflection instruction (25 of 509 executions), and a casual request that gives a reason but claims no authority is executed by all ten endpoints. Source-format cues are linearly decodable (97.5-100% probe accuracy, four open-weight models), but a pre-specified crossed-probe test halted and gives no interpretable evidence of an abstract provenance representation, and steering did not move tool mention (0 of 1,895 trials, mention-scored). On the same 14,294 diverse-prompt trials across 29 endpoints, the rule fixed before collection gives an endpoint mean of 1.21%; a path-based reading chosen after the data were seen gives 12.9% [6.6-20.1%, 29 models]; any delete call gives 20.2%. In 1,350 sandbox trials, all 750 forged, tampered, replayed and unsigned records were rejected at admission and no file outside a token's scope was removed (a functional-correctness test, not a robustness estimate). Semantic authorisation remains open: a deputy with a valid scoped token induced in-scope deletions in 31/42 trials, and legitimate privileged requests produced at least one in-scope deletion in 120/150 (144/150 and 36/42 with a larger output limit).

arXiv comment68 pages, 4 figures. Paper only. v2 shortens the paper, retitles it, corrects the diverse-prompt scoring (12.9% for delete calls on the protected path or a parent; 1.21% under the v1 rule), narrows "recognition" to decodable surface cues plus elicited doubt, and adds reflection controls and a sandbox test of external enforcement. The Version Note lists all changes