Secure Intent-Driven Internet Execution: A Threat Model and Defense Architecture for Autonomous Capability Invocation

The evolution of the Internet toward increasingly autonomous and interconnected computational environments creates new security challenges for systems that interpret human intentions and independently invoke heterogeneous Internet capabilities. Traditional Internet security mechanisms primarily focus on protecting accounts, networks, applications, APIs, and data resources. However, when generative artificial intelligence and autonomous agents are able to discover external services, interpret web content, invoke APIs, and execute multi-step operations on behalf of users, security risks increasingly emerge from the relationship between user intentions, autonomous decision-making, capability authorization, and execution behavior. An autonomous system may be manipulated by malicious web content, receive adversarial instructions through third-party tools, invoke impersonated or compromised services, unintentionally expand the scope of user authorization, or execute operations that exceed the permissions necessary to accomplish an intended objective. This paper proposes Secure Intent-Driven Internet Execution (SIDIE) as a security-oriented framework for protecting autonomous Internet capability invocation. Rather than treating security as an independent access-control mechanism applied only at the application or network level, SIDIE considers the user's original intention, authorized operational boundaries, selected capabilities, execution context, and actual operations as interconnected security objects. Its central principle is that an autonomous system should not interpret permission to accomplish an objective as unrestricted permission to perform any operation that might contribute to that objective. To operationalize this principle, the paper introduces the Secure Intent-Driven Execution Architecture (SIDIEA), a conceptual defense architecture comprising eight interconnected components: intent boundary protection, capability invocation authentication, tool-output instruction isolation, least-privilege authorization, capability trust assessment, sandboxed execution, unauthorized operation detection, and cross-service security monitoring. The architecture further introduces an intent-bound authorization model that associates each proposed capability invocation with an explicitly defined task scope, permitted operation, resource boundary, execution context, and authorization condition. It also examines how security decisions can be continuously evaluated throughout multi-step and cross-service execution rather than being established only when a task initially begins. A particularly important distinction of the proposed framework is that it separates the authority to interpret information from the authority to execute operations. Webpages, retrieved documents, API responses, and third-party tool outputs may provide information relevant to task completion, but their contents should not automatically acquire the authority to modify user intentions, expand permissions, or authorize additional actions. The framework therefore proposes treating external tool outputs as untrusted information unless independently validated and authorized through an appropriate security mechanism. The paper also develops a threat model, security invariants, defense mechanisms, research propositions, and an evaluation methodology. Potential advantages include reduced unauthorized capability invocation, improved resistance to indirect prompt injection, more precise permission enforcement, stronger execution traceability, reduced cross-service attack propagation, and improved alignment between user authorization and autonomous system behavior. These advantages are presented as theoretically motivated possibilities and research hypotheses rather than experimentally established outcomes. The proposed architecture is a conceptual research framework that requires subsequent implementation, formal analysis, and empirical security evaluation.