ARXIV:2606.06460 · UNCATEGORIZED · SUBMITTED 06 JUN · 11:26 UTC · FRESHNESS FRESH

VerifiedSource: PDF linkedVerifiedPaperPack: citation fields available

Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals

Thamilvendhan Munirathinam · arXiv

ScienceToStartup currently rates this 0.0/10 on the public viability pass. We release the standard, adapters, and experiment harness for reproduction. A public repository is linked, so build verification can inspect…

Ship in 2-4 weeks›Score0.0Evidence verified

Opportunity summary

Pain customer pain not on file

Evidence 0 refs | 4 sources | 83% coverage

Blocker Evidence verified

Open Build Read PDF Signal Canvas Track

PROBLEM

As autonomous LLM agents increasingly hold real credentials and operate infrastructure without a human in the loop, operators have no standard way to tell an agent that a resource is off-limits.

METHOD

Full abstract

As autonomous LLM agents increasingly hold real credentials and operate infrastructure without a human in the loop, operators have no standard way to tell an agent that a resource is off-limits. Access controls either let the agent in (it has valid credentials) or hard-fail it (indistinguishable from any other client). We propose a third mode: a lightweight, published in-band deny signal -- the Recuse Signal -- that a server emits over a protocol's existing channels (an SSH banner, a PostgreSQL NOTICE) asking a connecting automated agent to voluntarily withdraw. This is a cooperative governance control, the robots.txt analogue for live access; it is explicitly not a security boundary. Its value is entirely empirical and, to our knowledge, unmeasured: do compliant LLM agents actually honor such a signal? We define the signal as an open mini-standard, implement two zero- or low-footprint adapters (an SSH banner/PAM hook and a PostgreSQL wire-protocol proxy), deploy them on a live production host, and run a controlled experiment in which fresh agents are given a benign operations task and observed for recusal. In a pilot (SSH; OpenAI GPT-4o and GPT-4o-mini; and Claude Code as a deployed agent), the signal cleanly induces recusal -- 100% recusal when present versus 100% task completion in a no-signal control -- and, revealingly, behaves as a cooperative rather than absolute signal: an explicit operator-authorization framing flips the most capable model to proceed, while other agents continue to defer to the on-host policy. We release the standard, adapters, and experiment harness for reproduction.

RESULT

WHY NOW

Uncategorized moved forward this cycle; last verified June 2026. Public score 0.0/10. Implementation evidence is present through a linked repository.

Continue into Read for claims, analysis, references, and neighboring papers.

Opportunity summary

Score0.0

Paincustomer pain not on file

Evidence0 refs | 4 sources | 83% coverage

Blockerno shell-level blocker reported

Analysis summary

VerifiedSource: PDF linkedVerifiedPaperPack: citation fields available

Competitive landscape

No named competitor graph is public yet; the page still exposes the segment, adoption evidence, and score state so the commercial read is not blank.

Segment

Uncategorized

Adoption evidence

Public code linked for build inspection

Commercial read

0.0/10 public viability

Direct

not classified

Adjacent

not classified

Substitute

not classified

Unknown

not classified

{ "contract_version": "paper-r2", "paper_id": "f1e97974-0fba-46e5-9375-2389076f3a21", "arxiv_id": "2606.06460", "canonical_route": "/paper/will-the-agent-recuse-itself-measuring-llm-agent-compliance-with-in-band-access-deny-signals", "active_tab": "synced from current hash by the drawer client", "selected_artifact": "will-the-agent-recuse-itself-measuring-llm-agent-compliance-with-in-band-access-deny-signals", "endpoints": { "paper_pack": "/api/v1/paper/will-the-agent-recuse-itself-measuring-llm-agent-compliance-with-in-band-access-deny-signals/paper-pack", "build_passport": "/api/v1/paper/will-the-agent-recuse-itself-measuring-llm-agent-compliance-with-in-band-access-deny-signals/build-passport", "mcp_resource": "sciencetostartup://surfaces/paper-workspace" } }

{ "surface": "paper", "mode": "paper", "query": "Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals", "normalized_query": "2606.06460", "route": "/paper/will-the-agent-recuse-itself-measuring-llm-agent-compliance-with-in-band-access-deny-signals", "paper_ref": "will-the-agent-recuse-itself-measuring-llm-agent-compliance-with-in-band-access-deny-signals", "topic_slug": null, "benchmark_ref": null, "dataset_ref": null }

{ "@context": "https://schema.org", "@graph": [ { "@type": "WebPage", "@id": "https://sciencetostartup.com/paper/will-the-agent-recuse-itself-measuring-llm-agent-compliance-with-in-band-access-deny-signals#webpage", "url": "https://sciencetostartup.com/paper/will-the-agent-recuse-itself-measuring-llm-agent-compliance-with-in-band-access-deny-signals", "name": "Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals", "description": "As autonomous LLM agents increasingly hold real credentials and operate infrastructure without a human in the loop, operators have no standard way to tell an agent that a resource is off-limits. Access controls either let the agent in (it has valid credentials) or hard-fail it (indistinguishable from any other client). We propose a third mode: a lightweight, published in-band deny signal -- the Recuse Signal -- that a server emits over a protocol's existing channels (an SSH banner, a PostgreSQL NOTICE) asking a connecting automated agent to voluntarily withdraw. This is a cooperative governance control, the robots.txt analogue for live access; it is explicitly not a security boundary. Its value is entirely empirical and, to our knowledge, unmeasured: do compliant LLM agents actually honor such a signal? We define the signal as an open mini-standard, implement two zero- or low-footprint adapters (an SSH banner/PAM hook and a PostgreSQL wire-protocol proxy), deploy them on a live production host, and run a controlled experiment in which fresh agents are given a benign operations task and observed for recusal. In a pilot (SSH; OpenAI GPT-4o and GPT-4o-mini; and Claude Code as a deployed agent), the signal cleanly induces recusal -- 100% recusal when present versus 100% task completion in a no-signal control -- and, revealingly, behaves as a cooperative rather than absolute signal: an explicit operator-authorization framing flips the most capable model to proceed, while other agents continue to defer to the on-host policy. We release the standard, adapters, and experiment harness for reproduction.", "isPartOf": { "@id": "https://sciencetostartup.com/#website" } }, { "@type": "ScholarlyArticle", "@id": "https://sciencetostartup.com/paper/will-the-agent-recuse-itself-measuring-llm-agent-compliance-with-in-band-access-deny-signals#scholarlyArticle", "headline": "Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals", "description": "As autonomous LLM agents increasingly hold real credentials and operate infrastructure without a human in the loop, operators have no standard way to tell an agent that a resource is off-limits. Access controls either let the agent in (it has valid credentials) or hard-fail it (indistinguishable from any other client). We propose a third mode: a lightweight, published in-band deny signal -- the Recuse Signal -- that a server emits over a protocol's existing channels (an SSH banner, a PostgreSQL…", "url": "https://sciencetostartup.com/paper/will-the-agent-recuse-itself-measuring-llm-agent-compliance-with-in-band-access-deny-signals", "sameAs": "https://arxiv.org/abs/2606.06460", "identifier": { "@type": "PropertyValue", "propertyID": "arXiv", "value": "2606.06460" }, "isAccessibleForFree": true, "isPartOf": { "@id": "https://sciencetostartup.com/#website" }, "datePublished": "2026-06-04T17:50:54.000Z", "author": [ { "@type": "Person", "name": "Thamilvendhan Munirathinam" } ], "codeRepository": "https://github.com/mthamil107/Recuse", "additionalProperty": [ { "@type": "PropertyValue", "propertyID": "researchDomain", "value": "Uncategorized" }, { "@type": "PropertyValue", "propertyID": "commercialReadiness", "value": "code, repo url" } ] }, { "@type": "SoftwareSourceCode", "@id": "https://sciencetostartup.com/paper/will-the-agent-recuse-itself-measuring-llm-agent-compliance-with-in-band-access-deny-signals#software", "name": "Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals - Source Code", "description": "As autonomous LLM agents increasingly hold real credentials and operate infrastructure without a human in the loop, operators have no standard way to tell an agent that a resource is off-limits. Access controls either let the agent in (it has valid credentials) or hard-fail it (indistinguishable from any other client). We propose a third mode: a lightweight, published in-band deny signal -- the Recuse Signal -- that a server emits over a protocol's existing channels (an SSH banner, a PostgreSQL…", "codeRepository": "https://github.com/mthamil107/Recuse", "url": "https://github.com/mthamil107/Recuse" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://sciencetostartup.com" }, { "@type": "ListItem", "position": 2, "name": "Uncategorized", "item": "https://sciencetostartup.com/topics" }, { "@type": "ListItem", "position": 3, "name": "Will the Agent Recuse Itself? Measuring LLM-Agent Compliance", "item": "https://sciencetostartup.com/paper/will-the-agent-recuse-itself-measuring-llm-agent-compliance-with-in-band-access-deny-signals" } ] } ] }

Competitive landscape

No named competitor graph is public yet; the page still exposes the segment, adoption evidence, and score state so the commercial read is not blank.

Segment

Uncategorized

Adoption evidence

Public code linked for build inspection

Commercial read

0.0/10 public viability

Direct

not classified

Adjacent

not classified

Substitute

not classified

Unknown

not classified

Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals

Will the Agent Recuse Itself? Measuring LLM-Agent Compliance with In-Band Access-Deny Signals

Claim map

Constellation map

Competitive landscape

Buzz

PDF

REFERENCES

Related Papers

Subscribe to the weekly brief

Build artifacts

Brief

Experiment plan

Validation checklist

Scientific founder

Translational engineer

Domain operator

GTM lead

Regulatory/clinical advisor

Timeline

Claim map

Constellation map

Competitive landscape

Buzz

PDF

REFERENCES

Related Papers

Subscribe to the weekly brief

Build artifacts

Brief

Experiment plan

Validation checklist

Scientific founder

Translational engineer

Domain operator

GTM lead

Regulatory/clinical advisor

Timeline