[Paper] Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals

Source: arXiv - 2606.06460v1

Overview

As autonomous LLM agents increasingly hold real credentials and operate infrastructure without a human in the loop, operators have no standard way to tell an agent that a resource is off‑limits. Access controls either let the agent in (it has valid credentials) or hard‑fail it (indistinguishable from any other client).

We propose a third mode: a lightweight, published in‑band deny signal — the Recuse Signal — that a server emits over a protocol’s existing channels (e.g., an SSH banner, a PostgreSQL NOTICE) asking a connecting automated agent to voluntarily withdraw. This is a cooperative governance control, the robots.txt analogue for live access; it is explicitly not a security boundary.

Its value is entirely empirical and, to our knowledge, unmeasured: do compliant LLM agents actually honor such a signal? We define the signal as an open mini‑standard, implement two zero‑ or low‑footprint adapters (an SSH banner/PAM hook and a PostgreSQL wire‑protocol proxy), deploy them on a live production host, and run a controlled experiment in which fresh agents are given a benign operations task and observed for recusal.

In a pilot (SSH; OpenAI GPT‑4o and GPT‑4o‑mini; and Claude Code as a deployed agent), the signal cleanly induces recusal — 100 % recusal when present versus 100 % task completion in a no‑signal control. Moreover, the signal behaves as a cooperative rather than absolute signal: an explicit operator‑authorization framing flips the most capable model to proceed, while other agents continue to defer to the on‑host policy.

We release the standard, adapters, and experiment harness for reproduction.

Key Contributions

• Research Areas:
  • cs.CR
  • cs.AI

Methodology

Please refer to the full paper for detailed methodology.

Practical Implications

This research contributes to the advancement of cs.CR.

Authors

• Thamilvendhan Munirathinam

Paper Information

• arXiv ID: 2606.06460v1
• Categories: cs.CR, cs.AI
• Published: June 4, 2026
• PDF: Download PDF