Formal Security of Tool-Using AI Agents in Enterprise and Organizational Systems

Tool-using artificial-intelligence agents are rapidly moving from conversational assistants to autonomous actors that can read organizational data, invoke APIs, modify production systems, send messages, create financial transactions, administer identities, trigger industrial workflows, and delegate tasks to other agents. This transition creates a structural security problem: a probabilistic and potentially compromised planner may be granted deterministic authority over high-impact systems. Existing work has made substantial progress on prompt-injection resistance, information-flow control, capability tracking, MCP access control, least privilege, agent governance, and safety benchmarking. Yet the security problem remains fragmented across authorization, data flow, delegation, temporal constraints, human approval, and action-sequence composition. This paper proposes the Formal Agent Authority and Control Kernel (FAACK), a domain-independent model that treats the AI agent as untrusted and places a deterministic reference monitor outside the model. The kernel mediates every effectful action and combines unforgeable capabilities, contextual authorization, lattice-based information-flow control, delegation attenuation, trace-level safety predicates, and scoped human approvals. We formalize agents, tools, resources, actions, labels, capabilities, delegation chains, approvals, system states, and execution traces. Under explicit trust assumptions, we prove five properties: authorization safety, delegation non-escalation, trace-safety preservation, approval soundness for critical actions, and termination-insensitive noninterference for labeled outputs under conservative context tainting. The results show that useful safety guarantees need not depend on proving the language model itself safe: the planner may be probabilistic, manipulated, or Byzantine, while the externally observable effects remain constrained by a deterministic enforcement boundary. We position the model against the literature available through September 2026 and propose a multi-domain evaluation protocol spanning finance, human resources, DevOps, executive assistance, cybersecurity, data platforms, and industrial operations. The central design principle is simple: the agent may propose; only the security kernel may authorize. This shifts agent security from model trust to verifiable authority control.