Large language models increasingly operate as autonomous agents that select and invoke tools from large registries. We identify a critical gap: when unauthorized tools are visible in an agent's context, models select them in adversarial scenarios -- even when explicitly instructed otherwise. We propose a governed MCP proxy that enforces attribute-based access control (ABAC) at two points: tool discovery, where unauthorized tools are removed from the model's context window, and tool invocation, where a second check blocks any unauthorized call. Across three models (Qwen 2.5 7B, Llama 3.1 8B, Claude Haiku 3.5) and 150 adversarial tasks spanning four attack categories, our proxy reduces unauthorized invocation rate (UIR) to 0% while adding under 50ms median latency. Prompt-based restrictions reduce UIR by only 11--18 percentage points, leaving substantial residual risk. Our results show that architectural enforcement -- not prompting -- is necessary for reliable tool access control in deployed agentic systems.

翻译：大语言模型正越来越多地作为自主代理运行，从大型注册表中选择并调用工具。我们发现了一个关键漏洞：当非授权工具在代理的上下文中可见时，即使在明确禁止的情况下，模型在对抗性场景中仍会选择这些工具。我们提出一种受控的MCP代理，在以下两个节点强制执行基于属性的访问控制（ABAC）：工具发现阶段，将非授权工具从模型的上下文窗口中移除；工具调用阶段，通过二次检查拦截任何非授权调用。在三个模型（Qwen 2.5 7B、Llama 3.1 8B、Claude Haiku 3.5）及涵盖四类攻击的150项对抗性任务测试中，我们的代理将非授权调用率（UIR）降至0%，同时中位延迟增加不到50毫秒。基于提示词的限制仅将UIR降低11-18个百分点，仍存在显著残余风险。我们的结果表明，在部署的代理系统中，可靠的工具访问控制需要架构强制执行——而非提示词约束。