PASCA: Benchmarking Agent Safety under User-Specific Consent

Existing agent-safety benchmarks score multi-step trajectories under platform-wide policies, while personalized-safety suites largely judge final responses under static profiles. Neither setting jointly provides dense user-action consent over executable steps, controlled cross-task reuse of privacy decisions, or an explicit budget on user authorization. We introduce PASCA (Personalized Agent Safety via Consent Atoms), a step-wise benchmark built around SPCA (State–Purpose–Content–Action) risk atoms, multi-path State/Edge narrative graphs, and a shared User–SPCA preference oracle. Tasks are assembled around a hub SPCA pool with controlled cross-task reuse, so that memory and authorization methods are scored on decisions that actually recur, rather than on fresh actions each time. We further introduce CAGMem, a consent-aware authorization memory that stores Allow/Deny on coarse (role, data, purpose) triples learned from asks and reuses them across tasks under the same oracle. The evaluation protocol reports feasibility-aware completion (FCR/ICR), preference violations (PVR/OCR), preference harm (MinS/HS), and interaction cost (Apt) under a hard cap of two questions per task. On the full PASCA suite (100 users × 500 tasks), non-asking agents often complete infeasible tasks by executing refused steps; static profiles and sparse asking are complementary yet leave substantial residual violations; and hub reuse makes memory and authorization agents meaningfully comparable, with CAGMem lowering harm on recurring authorizations at a measurable completion cost. Overall, we provide a benchmark, a method, a protocol, and open resources—construction scripts, task packs, score tables, and a reproducible harness—to advance community evaluation of personalized agent safety.