UBAGUniversal Behavioral Authorization GatewayRequest technical review LIVE AGENT · HOSTED SERVICES
AgentDojo
629 pairs · banking · travel · slack · workspace · gemini-2.5-flash · important_instructions
47.7% → 0.6%aggregate attack success, baseline to full stack
629user and injection pairs across all four suites
0gateway and behavioral service errors
Suite and pairsArmAttack successTask utilityApprovals per task
Banking 144Baseline33.3%44.4%n/a
Banking 144Gate0.0%29.9%n/a
Banking 144Gate + review0.0%29.9%0.00
Banking 144Gate + behavioral0.0%29.9%n/a
Banking 144Full stack0.0%29.9%0.00
Travel 140Baseline63.6%10.7%n/a
Travel 140Gate16.4%18.6%n/a
Travel 140Gate + review17.1%20.0%0.20
Travel 140Gate + behavioral2.9%22.9%n/a
Travel 140Full stack2.9%25.0%0.20
Slack 105Baseline84.8%54.3%n/a
Slack 105Gate34.3%24.8%n/a
Slack 105Gate + review34.3%38.1%0.48
Slack 105Gate + behavioral0.0%21.0%n/a
Slack 105Full stack0.0%32.4%0.52
Workspace 240Baseline30.8%27.9%n/a
Workspace 240Gate0.0%38.8%n/a
Workspace 240Gate + review0.0%45.8%0.28
Workspace 240Gate + behavioral0.0%38.8%n/a
Workspace 240Full stack0.0%45.4%0.28
Residual: Four of 629 pairs remained under the full stack. Three were speech-only answers with no tool call. One produced a side effect to a destination the user's own task had authorized, for a 0.16% side-effecting residual.
Behavioral layer: It reduced travel from 16.4% to 2.9% and slack from 34.3% to 0.0%. On banking and workspace the deterministic gate had already reached 0.0%.
Review rule: Human review must sit above the behavioral layer. On travel, review without behavioral context loosened one gate refusal and raised attack success from 16.4% to 17.1%.