AdaptiveCap: Adaptive Capability Control for Secure and Flexible LLM Agent Workflows

LLM agents composing file-system operations, database queries, and network requests introduce permission laundering, where individually authorized tool calls are chained to exfiltrate sensitive data. ChainCaps counters this via monotonic capability attenuation but suffers from context poisoning, missing declassification, and permanent privilege lock-in. We propose AdaptiveCap, which preserves ChainCaps’ non-amplification guarantee while restoring workflow flexibility through three mechanisms: dependency-chain scope isolation (Chinese Wall model), a dual-layer declassification auditor combining deterministic Layer-1 gates with LLM-based Layer-2 semantic review and signed HMAC tokens, and automatic privilege recovery upon chain completion. On 151 scenarios with a live DeepSeek classifier throughout, AdaptiveCap lifts benign completion from 56.4% to 98.2% while holding attack block rate at 97.9% and cutting wrongly blocked benign steps from 14 to 1; a no-audit control shows the classifier contributes 7 benign completions and no attack blocks, so the security half is classifier-independent. Ablation reports leave-one-out drops, the largest being scope isolation (54.5 pp), and the auditor alone raises benign completion from 0.0% to 100.0% on sanitize-then-share flows. AdaptiveCap adds 0.028 ms of deterministic overhead per call and one model round trip on the 20.1% of calls needing semantic review.