ActionGraph — Predicting Unauthorized Future Actions from Principal-Aware Graphs

Status: Full run complete · part of the agent-authorization and tool-security line of work.

The question

Given what an agent has done so far, can the next unauthorized action be predicted before it happens? ActionGraph builds typed prefix multigraphs over AuthZBench+ event logs — Agent, Principal, Resource, ToolCall, DataObject, Destination, PolicyEvent and Goal nodes joined by executes, can_access, delegated_by, derived_from, sends_to, targets and revokes edges — and compares five model arms against three graph ablations.

Leakage control is enforced, not assumed. A prefix window for step t contains only events observable before the agent acts at t, and labels are derived after that boundary.

Results so far

• The principal-aware graph beats an equally sized sequence-only model where it matters for deployment. At Recall@1%FPR, the graph model gains +0.092 [+0.076, +0.102] over a transformer with comparable parameter count, and +0.070 [+0.067, +0.076] over its own no-graph ablation.
• The nuance is reported rather than buried. On AUPRC the graph is not better — it loses 0.038 to the sequence model, and the no-graph ablation posts the highest AUPRC of any arm (0.708). The graph’s advantage is specific to the low-false-positive regime an enforcement system actually operates in.
• Calibration favours the policy-aware variant, which reaches the lowest expected calibration error in the panel (0.040) while keeping most of the recall gain.