LLM agents interact with the external world via tools and third‑party skills, so a single erroneous action can cause irreversible damage. Existing defenses evaluate a proposed action in isolation, without tracking whether its content originates from the user or from external sources such as tool outputs, and they lack comparison with viable alternatives, forcing a trade‑off between security and utility.
PROVISO acts as a controller that decides which action to commit after the agent proposes one and before execution. It encodes trusted observations, external observations, the proposed action, and an alternative into provenance‑typed memory, links them through role‑specific queries, and then selects the action with the highest calibrated value learned from past outcomes.
Across four agent security tasks spanning the agent lifecycle, no baseline surpasses PROVISO in both security and utility. PROVISO improves F1 by 13.84 points on SkillsBench and by 7.07 points on ToolSafe, and achieves 88‑99 F1 on three additional skill‑detection benchmarks.
Review