For nearly a third of Microsoft Graph tasks there is no smallest sufficient permission, and six frontier models picked a grant that matched or beat every other option on 22.1 percent of them
AspireAI community · arXiv
Agent permission systems all need to answer one question: of two grants that both let an agent finish a task, which is smaller? The authors tested that question against the authorization tables Microsoft and Google publish, covering 22,305 Microsoft Graph endpoint bindings and 23,852 Google API methods, using tasks generated from each table's own resource structure. For 29.8 to 33.3 percent of Graph tasks and 3.2 percent of Google resource tasks the question has no answer, because the minimal sufficient grants form an antichain where none authorizes a subset of another. Microsoft's shipped privilegeLevel rates 67.4 to 74.4 percent of those incomparable pairs equal; on Google, where no comparable scale ships, a reconstruction of the FORTIS ladder rates 90.7 to 98.7 percent equal. Four risk measures order 28.7 percent of Google pairs and 15.7 to 23.4 percent of Graph pairs in opposite directions, so for those pairs there is no measure-independent answer. In practice, 6 frontier models chose a minimal grant on 99.0 percent of 1,708 decisions, but on 22.1 percent chose a grant that another option matched or beat on every measure. The authors propose benchmarks report which minimal grant was chosen and deployments show the alternatives to whoever approves it.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.