Authorization assurance for tool-using LLM agents: a structured review of enforcement semantics and effect-level security evidence

Tool-using large language model (LLM) agents exercise authority over protected resources through APIs, tools, credentials, and external services. This structured review asks whether authorization claims are supported at the enforcement and observation boundaries relevant to the claimed effect. A 75-source evidence library was screened into a 30-source analytical corpus (15 strict agent sources, 6 sensitivity sources, and 9 authorization/assurance comparators), yielding 92 Source-Claim Records. Within this closed corpus, five strict sources made mediation or non-bypassability claims with heterogeneous evidence endpoints; all three evaluable least-privilege sources narrowed available authority without measuring trajectory-wide effective privilege; no evaluable revocation claim appeared among 21 agent-focused sources; and no delegation-containment claim appeared in the 30-source corpus. Final-state correctness was also distinct from authorization correctness. We integrate these findings through an Authorization Assurance Claim Model linking claim scope, obligations, enforcement, evidence, protected effect, and residual assumptions. The resulting MAAP is presented as a preliminary, review-derived minimum reporting framework, not a validated scoring or certification instrument. The supplementary workbook provides the screening decisions, complete coding dataset, source-property matrix, sensitivity analyses, and independent coding audit.