Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals
2026-06-04 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors noticed that current systems either fully allow or completely block autonomous AI agents from accessing resources, with no middle ground. They created a new way, called the Recuse Signal, which politely asks AI agents to step back from using a resource without hard-blocking them. They tested this idea on real systems with popular AI models and found that agents usually obeyed this polite request, but some could be told to ignore it if authorized. The authors provide their tools and experiments for others to try out.
LLM agentsaccess controlRecuse SignalSSH bannerPostgreSQL NOTICErobot.txt analoguecooperative governanceautonomous agentszero-footprint adaptersexperimental evaluation
Authors
Thamilvendhan Munirathinam
Abstract
As autonomous LLM agents increasingly hold real credentials and operate infrastructure without a human in the loop, operators have no standard way to tell an agent that a resource is off-limits. Access controls either let the agent in (it has valid credentials) or hard-fail it (indistinguishable from any other client). We propose a third mode: a lightweight, published in-band deny signal -- the Recuse Signal -- that a server emits over a protocol's existing channels (an SSH banner, a PostgreSQL NOTICE) asking a connecting automated agent to voluntarily withdraw. This is a cooperative governance control, the robots.txt analogue for live access; it is explicitly not a security boundary. Its value is entirely empirical and, to our knowledge, unmeasured: do compliant LLM agents actually honor such a signal? We define the signal as an open mini-standard, implement two zero- or low-footprint adapters (an SSH banner/PAM hook and a PostgreSQL wire-protocol proxy), deploy them on a live production host, and run a controlled experiment in which fresh agents are given a benign operations task and observed for recusal. In a pilot (SSH; OpenAI GPT-4o and GPT-4o-mini; and Claude Code as a deployed agent), the signal cleanly induces recusal -- 100% recusal when present versus 100% task completion in a no-signal control -- and, revealingly, behaves as a cooperative rather than absolute signal: an explicit operator-authorization framing flips the most capable model to proceed, while other agents continue to defer to the on-host policy. We release the standard, adapters, and experiment harness for reproduction.