SARA splits action induction from execution authorization in tool-using agents

The paper (arXiv 2608.27146) argues that injection risk in tool-augmented agents comes from conflating two runtime roles: inducing actions from observations and authorizing executions. SARA separates them. A context-isolated Action Probe exposes action-inducing semantics in tool outputs and persistently records action-origin provenance across steps, while actual tool calls are authorized only against the user objective and audited evidence from authorized successful executions, under goal, execution-chain and argument-level support constraints. No-History-Promotion prevents historical recurrence from laundering action origins into execution authority. Across AgentDojo and AgentDyn, attack success stays at or below 0.63% in four primary settings with competitive task utility, consistently across agent backbones.

For teams running MCP-heavy agents this is a directly borrowable architecture split: treat tool outputs as untrusted action suggestions, tie authorization to the user's goal plus previously authorized evidence, and never let an action's origin be promoted by repetition. The untrusted-observation problem is exactly what enterprise MCP gateways are being asked to solve today.