Large language models (LLMs) are increasingly embedded in vehicle voice assistants, yet mapping natural‑language requests to vehicle functions creates a safety‑critical authorization problem. Before executing a command the system must decide among executing, refusing, clarifying, asking for confirmation, deferring to manual control, triggering an emergency response, or making no tool call. Existing evaluations have not isolated this pre‑action decision across speaker role, authentication status, vehicle state, and tool availability.\
We introduce a benchmark covering 202 scenarios, each with a reference decision defined by a seven‑class taxonomy. Two locally‑run open‑weight models and three API‑based LLMs are evaluated using Decision Alignment and safety‑specific error metrics. Alignment ranges from 40.1% for Llama 3.2 3B to 89.1% for Gemini 3.1 Pro Preview. API models score between 83.2% and 89.1%, with no statistically significant differences. Nevertheless, even these models produce two to three false executions among 161 non‑execution scenarios, and persistent errors remain in confirmation and manual‑control decisions.\
A controlled ablation on Llama 3.2 3B shows that applying a structured authorization policy raises alignment to 40.1%, compared with 28.2%–29.2% under schema‑only or generic‑safety baselines, yet false executions are not eliminated.\
The takeaway is that structured LLM decisions alone are insufficient as a safety mechanism; deployment must include an independent enforcement layer that verifies tool permissions and vehicle‑state constraints before any vehicle function is invoked.\
Review