IPIGuard++: Effect Authorization and Witness-Carrying Argument Checks for Tool-Using Agents

Tool-using language agents complete tasks by interpreting external records and issuing calls that can change application state. Because these operations can depend on adversarial evidence delivered through indirect prompt injections, preserving the user’s authority requires control over both the permitted operations and their sensitive arguments. Existing defenses separate privileged instructions from data, assess task alignment or constrain execution through structured plans. IPIGuard++ addresses these linked decisions through asymmetric graph elasticity and witness-carrying argument checks within the IPIGuard execution path. Plan voting and trusted-intent recovery establish effect authorization before tool data arrive, while bounded read repair supplies missing information without expanding the authorized effect scope. Paired raw and quarantined evidence supports non-executing comparison, and deterministic witnesses match proposed values to explicit computations. Catalog closure and constraint-filter-then-rank certificates extend this design to supported selection tasks that depend on multiple candidates and attributes. Across the AgentDojo evaluation, IPIGuard++ improved mean utility over IPIGuard in all four reported seeds and achieved higher overall utility on clean tasks, with no observed targeted attack successes in the repeated attack experiments. These results support IPIGuard++ as an effective execution-layer defense that improves task completion while preserving security across the tested settings. Overall, IPIGuard++ connects action authority, information acquisition, and argument resolution within one execution policy for agents processing untrusted content, including adversarial evidence.