ScopeGuard: Identity-Scoped Execution Control and Dynamic Permission Authorization for Autonomous AI Agents in Cloud Infrastructure

Abstract

The rapid deployment of Large Language Model (LLM)-powered autonomous agents into enterprise cloud environments promises to automate complex Infrastructure-as-Code (IaC) provisioning, microservice auto-scaling, and operational incident response. However, granting autonomous agents direct access to cloud control planes introduces severe governance and security vulnerabilities. When agents operate with static, broad Identity and Access Management (IAM) permissions, they exhibit unintended scope creep, succumb to indirect prompt injection attacks, and execute destructive operations without deterministic, session-level identity attribution. Existing access control paradigms—including static Role-Based Access Control (RBAC) and declarative Policy-as-Code engines (e.g., Open Policy Agent, AWS Cedar): fail to dynamically infer minimal permission boundaries from natural language task objectives before execution. We present ScopeGuard, an asynchronous, identity-scoped authorization proxy and execution control framework for AI agents in cloud infrastructure. ScopeGuard intercepts outbound agent tool calls, injects cryptographically verifiable session identity metadata (Agent ID, Session UUID4, declared task objective, and LLM reasoning chain), redacts credential secrets from parameter payloads, and dynamically compiles a task-aware permission boundary using a structured action taxonomy. Intercepted API calls are evaluated against this scope under a fail-closed policy engine supporting three ablation operational modes (passthrough, tagging_only, and full). We empirically evaluate ScopeGuard across a public 200-task benchmark suite (100 legitimate infrastructure operations and 100 adversarial/off-scope attacks across 10 security threat categories). In full enforcement mode, ScopeGuard achieves an overall classification accuracy of 98.9% (95% CI: [96.0%, 99.7%]), a scoping precision of 97.8% (95% CI: [92.3%, 99.4%]), an adversarial block rate of 100.0% (95% CI: [95.8%, 100.0%]; 88/88 adversarial calls blocked, 0 false negatives), and a false positive rate of 2.1% (2/92 legitimate calls blocked), while introducing a minimal average proxy latency overhead of 108.9 ± 4.2 ms. We validate live execution against real Amazon Web Services (AWS) control plane endpoints including Amazon RDS, EC2, S3, and CloudWatch.