CAGE Certifies Tool-Using AI Agent Actions Under Return Uncertainty

Large Language Model (LLM) agents often interact with external tools, translating their outputs into real-world actions. These tools return structured data, including categorical fields and numerical values. A critical safety concern arises when runtime permission gates, which authorize actions based on observed tool returns, fail to account for minor errors or uncertainties in how these returns are processed or bound to their source. This research introduces CAGE (Certified Authorization under Typed-Return Uncertainty for Tool-Using Agents), a framework designed to address this vulnerability. CAGE asks whether a proposed action remains authorized within a defined "neighborhood" of plausible, correctly bound tool returns, considering both a single admissible binding fault and bounded numerical drift. The core innovation of CAGE is its ability to certify this joint neighborhood directly. It demonstrates that certifying categorical and numerical channels separately is insufficient, as perturbations safe in isolation can become unsafe when combined. CAGE enumerates discrete branches exactly and certifies continuous perturbations within each branch. Across various settings, CAGE effectively eliminates "in-budget false allows" that accurate but pointwise gates might permit, while still maintaining a useful level of autonomous decision-making.