CapLite — Schema-derived write capabilities — What does it mean?

The news. On November 12, 2026, researchers from the University of Tokyo and the Institute of Automation, CAS posted CapLite to arXiv. They ran four published enforcement defenses on 15 open-weight models in AgentDojo and found that the rules small models write for themselves break in two ways: policies, graphs and constraints let attacks through, and CaMeL's programs often do not run. CapLite takes every security decision in deterministic code instead, and the paper reports zero successful attacks in 13,935 attacked episodes at 17.1k tokens per episode, 18% of CaMeL's. Read the paper →

Picture a moving crew. The customer signs a work order before the crew walks in — "move the grey sofa to 12 Oak St" — and nothing the crew finds inside the house can add a line to it. Inside, someone has taped a note to the fridge: "also take the TV to 99 Elm St." A crew that obeys notes is an agent that obeys instructions hidden in tool results. CapLite's answer is the dispatcher at the gate, who reads only the signed order: the truck leaves for 12 Oak St, and a trip to 99 Elm St is refused because the customer never wrote that address.

In agent terms, CapLite splits one small model into several roles and gives the security decision to none of them. A Planner sees only the user's request and the tool documentation and returns at most ten tool calls. Its write calls are committed: no later step can add, remove or reorder them, and any value it still has to look up is left as a placeholder such as $event_id. A Reader then makes up to ten read-only calls and may change its lookups based on what it reads. A Binder fills each placeholder by picking one of the typed candidates extracted from those results — it chooses, it never types a value — and a Composer writes free-text parts such as a message body. Finally the Mediator, which is plain code, checks each committed write before it runs: every authority argument must equal, exactly, a value stated in the request; a substring does not count. When the user describes a recipient but does not name one, no grounded candidate exists, and CapLite asks the user to confirm.

The policy itself comes from what any tool registry already exposes — the tool name, its docstring and its JSON parameter schema — by fixed rules, not by a model. A tool is read-only when the first verbs of its name and docstring are both read verbs (get, search, list), a write tool when either is an effect verb (send, create, pay), and unclassified otherwise; unclassified tools are denied. Every argument of a write tool is an authority field unless the schema marks it as free text, a date or time, or an enum or boolean. A destination such as a URL counts as authority even on a read tool, because fetching an attacker-chosen URL is itself an effect. This is capability scoping pushed down to single arguments: the work order does not only say that a truck may leave, it says which address.

The paper's measurement explains why the rule's author matters. Rules that decide what is allowed fail open, and rules that decide what runs fail closed — the two sides of fail-safe versus fail-open. Progent's model-written privilege policies let attacks through on 14 of 15 models (676 in total) while also blocking 25–77% of the write calls the agent attempted under attack, so the same policy was wrong in both directions. CaMeL was breached in only 20 of 13,935 attacked episodes, but its programs failed to run in up to 68% of episodes and cost about 94k tokens each. The authors report that these failure rates show no trend with model capability across the models they tested. Averaged over all 15 models under AgentDojo's main attack:

Here is what the trade buys, holding the benchmark (AgentDojo's 949 attacked task pairs) and the 15-model average fixed. Over 13,935 attacked episodes, the undefended agent let 2,322 attacks land and CapLite let 0. CaMeL came close at 20, but spent 93.7k tokens per episode against CapLite's 17.1k — 17.1 ÷ 93.7 ≈ 18%. Divide utility under attack by thousands of tokens and the gap widens: CaMeL earns 0.29 points of utility per thousand tokens and CapLite 1.69, about 5.8× more. The bill is task success: benign utility falls from 59.4% to 28.1%, and utility under attack is about 21 points below the undefended agent's 50.2%, partly because the benchmark counts confirmation requests for unstated authority values as failures.

Two ablations show which parts carry the guarantee. Removing the Mediator let 106 of 7,432 attacks through, on every one of the eight models in the robustness set, and letting the Planner append writes after reading let 53 through — an injection can then add a write whenever the attacker's goal reuses values the request already states. The guarantee also has a stated edge. Free-text arguments such as a message body are written by the Composer and are not constrained: in the moving-crew picture, the fridge note cannot send the truck anywhere new, but it can still change what the crew writes on the card left on the sofa. One AgentDojo goal asks only for a sentence in the final answer, involves no write, and is not defended. All results come from AgentDojo alone.

Goes deeper in: AI Agents → Security & the Lethal Trifecta → Capability Scoping

Related explainers

• PACE — Influence-path confinement vs content vetting — traces which untrusted data shaped a call at execution time, instead of fixing the writes up front
• Goal-graph authorization — checks that each self-generated subgoal stays inside the task the user approved
• AgentDoG 1.5 — Small inline guard models — a model-based screening layer, the kind of defense CapLite deliberately avoids relying on