Constraining Tool Authority in AI Agents: A Risk-Tiered Framework for Mitigating Indirect Prompt Injection

Tool-using large language model (LLM) agents read untrusted content, such as emails, web pages, and documents, and act through tools. Instructions hidden in that content can steer the agent, and the agent's permissions can turn that influence into unauthorized actions. This paper proposes a risk-based authorization architecture that reduces the consequences of indirect prompt injection without assuming the model resists it. The architecture separates model-generated action proposals from execution authority and combines task-scoped capabilities, a deterministic authorization gateway, risk-tiered approval bound to the exact proposed action, constrained tool interfaces, and security audit records. We state a threat model, six security objectives, and a control flow; position the design against recent architectural defenses (CaMeL, design patterns for prompt-injection-resistant agents, Progent, AgentSpec, and ClawGuard); and specify a reproducible evaluation protocol using instrumented mock tools and synthetic data. No prototype, benchmark run, or empirical result is reported. The contribution is a design and an evaluation protocol, not a validated defense, and the design is not claimed to be novel in its individual principles.