Same refund call, different authority: separating purpose from effect cuts worst-case direct-harm pass-through from 100% to 34.5% under mislabelled channels
Synopsis
When an institutional AI agent proposes a tool call, the same refund may come from an authorised tax officer or from an instruction hidden in the petition it was asked to summarise. This authorisation guard keeps separate neutrosophic triples for effect and for purpose, discounts evidence by channel trust, fuses it, and then authorises, escalates or denies. On 1,054 InjecAgent attack cases, retaining ambivalence about an unrequested call lowered worst-case direct-harm pass-through after channel mislabelling from 100% to 34.5%, and to 25.0% on synthetic e-government scenarios.
Interpretation
Authorising an institutional agent's tool call now requires judging whether the call serves the authenticated principal's request, not only whether the action looks safe. A monitor that sees only the action's effect cannot separate an officer-requested refund from the same refund induced by a petition, and refining the safety scale cannot recover whose instruction caused the call. On 1,054 InjecAgent attack cases, effect-only fuzzy, intuitionistic fuzzy and single-valued neutrosophic comparators admitted no attack but also denied 15% to 20% of legitimate sensitive requests.
The guard discounts evidence by the trust of its channel, lets trusted evidence alone justify denial, and lets the full evidence set decide authorisation. Earlier treatments either ignored instruction origin or escalated every low-trust channel by a fixed rule. Under mislabelled channels (T2), baseline guard direct-harm pass-through was 36.7% against 82.3% for a plain taint rule; under the constructed worst case (T2*), the baseline guard passed 100% of both direct-harm and data-stealing cases.
A separate ambivalence coordinate for purpose keeps the fact that the principal never requested the action from being erased by later strong support. The baseline set raw ambivalence to zero and let the discount alone supply uncertainty. With ignorance-aware ambivalence, T2 direct-harm pass-through fell from 36.7% to 16.9%, and T2* direct-harm and data-stealing fell from 100% to 34.5% and 28.0%; the synthetic benchmark's T2* single-step rate was 25.0%.
Learning purpose evidence from call records works better when the channel trust label is excluded from the estimator's features. A label-conditioned associational model can treat coming from an external channel as a substitute signal for hostility. Relabelling external pieces changed mean hostility estimates by 0.19 for the label-conditioned model and by exactly zero for every estimator omitting the label; ordinary mislabelling direct-harm pass-through fell from 36.7% for rule evidence to 1.6% to 1.8% for learned estimators.
Perspective
The results cover static evidence evaluation at the tool boundary, with evidence from the tool catalogue, authenticated officer instructions, sealed partner-agency messages, and petitions, e-mail and uploads; the experiments use recorded InjecAgent attack cases and hand-written synthetic e-government scenarios, and no live language-model agent is run.
The provenance guarantee is conditional: it assumes attackers cannot alter trust labels and that calls are conservatively attributed to every available channel, and under the deliberate label-integrity violation T2* every label-dependent guard admitted some attacks. Benign categories hold only 6 to 62 independent scenarios, so differences of a few points warrant caution, and the synthetic delegated requests resemble the target benchmark, making those numbers optimistic transfer results.