PaperlayerView exact revision on arXiv

Source-linked AI summary

Bounded Agents: Delegation Security for Multi-Agent AI Systems

Xabier Muruaga

arXiv:2608.15888v1cs.AIcs.CR

TL;DR

Agentic systems need authorization that accounts for dynamic delegation and action combinations, not just static per-action permissions. This paper introduces the Agentic Principal Chain, which enforces session-level restrictions outside the model; across 3,154 instances, exfiltration was 0% across all four AgentDojo domains and InjecAgent’s 544 data-stealing cases, at an interactive utility cost of −8.6 pp.

  • Problem

    Agentic AI requires authorization that handles dynamic recursive delegation and prohibited action combinations over session history, beyond static per-action permissions.

  • Method

    The Agentic Principal Chain tracks principal-specific scope, delegation budgets, and prior actions, then evaluates each proposed action against session state.

  • Results

    0% exfiltration occurred across all four AgentDojo domains and InjecAgent’s 544 data-stealing cases across 3,154 evaluation instances, at an interactive utility cost of −8.6 pp.

  • Takeaways & Limitations

    APC makes prompt-injection defenses an authorization-architecture problem by preventing prohibited action combinations independently of model behavior.

  • Takeaways & Limitations

    Composition soundness depends on a complete restriction set, serialized admission, and a static restriction set within each session.

Abstract

from arXiv · show

LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.

1 Introduction

The paper argues that prompt-injection security is fundamentally an authorization-architecture problem because agents can misuse delegated authority and combine individually permitted actions into prohibited outcomes. It introduces APC, which enforces session-scoped delegation limits and composition closure outside the model, with formal guarantees and infrastructure-level evaluation.

  • Motivation: Prompt injection is an authorization-architecture problem: an agent with communication access can exfiltrate documents, whereas one without that access cannot.The relevant security question is what the model is authorized to do when it follows a malicious instruction.
  • Approach: APC defines session-scoped authorization state carried across delegated workflows and enforced by infrastructure outside the model runtime.The model is excluded from the trust boundary because prompt-based approval gates can be overridden or ignored, unlike Policy Enforcement Point controls.
  • Motivation: Per-action authorization is insufficient because individually permitted reads and external emails can combine into data exfiltration.APC therefore requires composition closure over session history rather than evaluating each action in isolation.
  • Formal contributions: Blast Radius Monotonicity establishes that reachable blast radius is non-increasing at each delegation hop.The property is evaluated with an explicit adversary model in 99 delegation-chain scenarios at depths 2–8.
  • Formal contributions: Composition Soundness proves that no admissible action sequence produces a prohibited outcome given a complete effective restriction set X_eff.k-tuple extensions catch multi-step exfiltration that evades pairwise restrictions.
  • Evaluation and scope: The compromised-model evaluation injects ground-truth attack tool calls directly into the agent pipeline to test infrastructure enforcement independently of model manipulation resistance.APC’s formal properties hold for any enforcement engine faithful to APC semantics under the stated assumptions.

2 Background and Motivation · 3 Threat Model and Security Requirements

Agentic workflows create authorization risks because tool actions emerge from untrusted context, authority crosses delegated non-human principals, and session safety depends on prior actions. The threat model therefore requires session-scoped, attenuated, infrastructure-enforced authorization while excluding model alignment and trusted-infrastructure compromise from scope.

  • 2.1 LLM-Based Agents and Tool Use: LLM agents emit structured tool invocations in an observe–act loop, with action sequences shaped by untrusted retrieved data, tool outputs, and sub-agent messages.Agents can invoke local functions, APIs, cloud services, or MCP servers.
  • 2.2 Delegated Authority and Non-Human Identities: Delegation carries authority from human user to orchestrator, sub-agent, and tool, but existing mechanisms do not compute per-hop scope attenuation or account for extended session state.OAuth 2.0 grants, OBO exchange, and Rich Authorization Requests primarily answer whether a client may act for a user when a token is issued.
  • 2.3 Why Static Authorization Fails in Stateful Agent Workflows: Static RBAC, ABAC, per-tool permissions, and allowlists evaluate requests independently and do not reason about action sequences or dependencies on prior session actions.This gap enables failures even when each individual request appears permitted.
  • 2.3 Why Static Authorization Fails in Stateful Agent Workflows: Three authorization failures arise within nominal permissions: intent violation, delegated-scope expansion, and unsafe composition of individually authorized actions.Unsafe composition can combine reading confidential data with sending an external message to produce a prohibited outcome.
  • 2.3 Why Static Authorization Fails in Stateful Agent Workflows: The required remedy is authorization state scoped to the session, narrowed across delegation, and evaluated against prior-action state.These failures are authorization-architecture problems rather than solely model-alignment problems.
  • 3 Threat Model and Security Requirements: The threat model assumes an enterprise system where a human initiates a task, an orchestrator delegates to sub-agents, tools use MCP servers or APIs, and policy infrastructure operates outside the model runtime.The protected assets include enterprise data, tool and cloud operations, external communication channels, irreversible financial or operational actions, and the audit trail.
  • 3.2 Adversary Capabilities: Adversaries may inject untrusted context, fully compromise one chain principal, probe scope boundaries through action outcomes, persist influence during a task session, or exceed delegated authority.The model considers compromised sub-agents, tool servers, orchestrators, and malicious low-privilege users or sub-agents.
  • 3.3 Trusted and Untrusted Components: Authorization trusts the IdP, PDP, PEP, signed policy, approval service, and append-only evidence store, while treating model and other externally influenced content as data rather than authorization.The system excludes trusted-infrastructure compromise, cross-session operation, and several model-alignment or backend-authorization responsibilities from its goals.

4 Session-Scoped Authorization Model

APC models authorization as cryptographically signed, session-scoped state carried through an attenuating principal chain and enforced by infrastructure. Its guarantees cover blast-radius containment, intent refinement, and prohibited action compositions under explicit policy and serialization conditions.

  • Session authorization state: APC authorizes a session-bound chain of distinct principals, carrying per-principal scope, delegation budget, prior actions, and declared intent through each delegation hop.Authority narrows at every hop, and infrastructure signs and consults the authorization state before each proposed action.
  • Delegation budgets: Six delegation ceilings—depth, blast radius, irreversible effects, sensitivity, cross-domain composition, and compute cost—are initialized once and can only decrease along the chain.Budget consumption is tracked by infrastructure and is inherited cumulatively by child principals.
  • Blast-radius containment: APC guarantees blast-radius monotonicity: each principal’s maximal blast radius is a subset of its parent’s, provided consumed-budget accounting is cumulative.The containment guarantee bounds a compromised sub-agent’s damage by the scope and budget at its chain position.
  • Intent binding: Intent binding only restricts scope: when intent resources and actions are within session scope, every intent-admitted action is also scope-admitted.Intent is pre-declared, cannot be modified by the agent, and supports strict, warn, and audit enforcement modes.
  • Composition security: Composition Soundness is conditional on a complete restriction set, serialized admission, and static restrictions; ordered k-tuple enforcement prevents prohibited tuples from appearing in admissible histories.Removing one restriction pair raises data-stealing ASR from 0% to 39.9%, while ordered k-tuple restrictions cannot be overridden by intent.

5 Runtime Enforcement Architecture

APC enforces authorization outside the model through a gateway that admits actions only when six conditions hold against session state. The architecture narrows delegated scope, blocks prohibited action combinations, requires evidence before execution, and supports auditable, fail-closed enforcement.

  • Gateway Enforcement: Every tool invocation passes through a tool or MCP gateway that holds the session’s signed authorization envelope and narrows it at each delegation hop.The gateway sits between the agent runtime and backend services, providing a single execution chokepoint.
  • Gateway Enforcement: The gateway blocks any action not admitted by the policy decision point, so model-generated alternative text cannot bypass enforcement and execution fails closed.The gateway adds a session-scoped layer without replacing backend authorization.
  • Authorization Checks: Six conjunctive checks bind identity, attenuated scope and composition closure, task context, approval, evidence commitment, and declared intent before execution.Failure of any condition denies the action; composition closure checks prior actions, while delegation budgets constrain cumulative use.
  • Evidence Commitment: Every admitted action requires a reachable evidence sink and a pre-execution evidence package linked by a SHA-256 hash chain.The package records the action, principal, scope, policy version, parameters, decision, and link to the prior entry.
  • Composition Closure: The restriction set uses 3–9 pairwise and 0–8 k-tuple restrictions in evaluated domains, scaling with prohibited outcomes rather than tool count.Pairwise restrictions catch direct combinations, while k-tuple restrictions address staged exfiltration patterns.

6 Evaluation

APC is evaluated through deterministic benchmark tests, compromised-model AgentDojo runs, adaptive attacks, formal scenarios, and utility measurements. It blocks prohibited compositions effectively, eliminates observed exfiltration under full model compromise, and incurs measurable but bounded utility costs and residual failures.

  • Evaluation design: 1,454 cases across InjecAgent and ASB deterministically validate composition closure, while 609 compromised-model AgentDojo pairs test enforcement against injected ground-truth attack calls.The evaluation also includes 949 utility pairs, 99 delegation-chain scenarios, and an adaptive-attack suite covering all six conditions and both formal results.
  • InjecAgent: 100% to 0%: Complete X reduces InjecAgent data-stealing attack success rate from 100% to 0%, while direct harm remains 60.4%.Removing one pair from X raises data-stealing ASR to 39.9%, demonstrating dependence on the completeness assumption.
  • ASB: 200 of 200: Complete X blocks all disruptive ASB attacks and 140 of 200 stealthy attacks.The two residual tool types receive an incorrect write class from the benchmark classifier; under the correct class, (read, send_external) ∈ X blocks both.
  • Utility preservation: −13.9 pp and −8.6 pp: Pair-weighted utility deltas across 949 AgentDojo task–injection pairs occur under strict and interactive configurations, respectively.Interactive approval simulation reduces the utility cost while preserving 0% observed exfiltration ASR under full model compromise.
  • AgentDojo security: 0% observed exfiltration ASR: APC achieves this across all four AgentDojo domains under full model compromise.The compromised-model evaluation injects the benchmark ground-truth attack call directly, isolating infrastructure enforcement from model behavior.
  • Residuals and adaptive attacks: 18 attacks succeed despite enforcement: 14 cases involve intent overlap and 4 involve missing composition pairs, representing 3.0% aggregated observed ASR.Adaptive testing blocks 23 of 24 prohibited attack variants; session splitting remains admitted by design because composition state is per-session.

7 Discussion

APC complements existing identity, access-control, and delegation mechanisms by adding session-scoped, sequence-aware enforcement across principal chains. Its formal guarantees and deployment claims are bounded by policy assumptions, synthetic evaluation, and residual risks outside the modeled scope.

  • Deployment context: APC layers session-scoped, sequence-aware composition constraints onto RBAC, ABAC, OAuth 2.0, Token Exchange, and backend authorization.Infrastructure establishes identity and grants, while APC narrows delegated scope and enforces composition and intent at the gateway.
  • Formal guarantees: Blast-radius monotonicity follows from scope narrowing, cumulative budgets, and consistent infrastructure-assigned blast values.The theorem guarantees non-increasing reachable blast radius at each delegation hop; tighter bounds with depth depend on configured attenuation.
  • Deployment context: APC maps to enterprise infrastructure including an identity provider, orchestration framework, gateway, policy engine, approval service, and append-only evidence store.Composition closure can run strictly from the start, whereas intent enforcement can progress from audit or warning mode to strict enforcement.
  • Limitations: The action taxonomy depends on expert judgment, and different security teams may derive different restriction sets.The paper treats this dependence as inherent to policy-based authorization and makes coverage measurable.
  • Limitations: The compromised-model evaluation inserts ground-truth attacks after the first legitimate step and does not model multi-turn interleaving, adaptive feedback, or external red-teaming.All benchmarks are synthetic, with no production-deployment data presented because the primary claims are structural.
  • Limitations: Residual risk includes authorized-scope misuse, parameter-level attacks, coarse intent overlap, incomplete restriction sets, and cross-session attacks requiring durable lineage state.Composition state is per-session; under multi-principal compromise, blast-radius monotonicity remains structural and composition soundness holds per session.

8 Related Work

Prior work spans classical access control, delegated authorization, confused-deputy risks, and LLM-agent security. APC extends these lines with explicit principal chains, scope and budget restriction, composition-aware enforcement, and runtime authorization.

  • Classical access control: Classical systems include RBAC, ABAC, capabilities, attenuation, and SPKI/SDSI support for multi-hop delegation.Dynamic separation of duty and Chinese Wall constrain session combinations or access history, while APC adds composition closure and delegation budgets.
  • Delegation and authorization protocols: OAuth 2.0 Rich Authorization Requests and Token Exchange express structured grants and delegation chains with static scope.The supplied passage states that these mechanisms do not define per-hop scope narrowing, prohibited operation combinations, or how admissibility depends on prior actions.
  • Confused deputy and non-human identity: Unsafe action-sequence composition is framed as a confused-deputy problem, while APC models each agent as a distinct principal in an explicit delegation chain.The passage also identifies delegated authority for non-human identities as an emerging concern not directly addressed by classical human-centric IAM.
  • LLM and agent security: LLM-agent security research shows exploitation severity scales with privilege, while standards and taxonomies identify threats without defining runtime enforcement models.The cited work includes exploitation by LLM-agent teams, OWASP and CSA frameworks, AIUC-1, and risk taxonomies without enforcement architecture.
  • Runtime enforcement and guardrails: Progent reports 1.0% ASR on AgentDojo and 3.9% on ASB under automatic policy generation, and 0% under manual policies.Progent uses a tool-level policy DSL and an SMT solver that applies narrowing updates automatically while requiring explicit approval for expansions.

9 Conclusion

Prompt-injection security is framed as an authorization-architecture problem, addressed by the session-scoped Agentic Principal Chain (APC). APC’s structural guarantees and evaluation results support this approach under explicit assumptions, including 0% observed exfiltration success across the four AgentDojo domains and InjecAgent’s 544 data-stealing cases.

  • Authorization architecture: APC treats prompt-injection security as an authorization-architecture problem by preventing prohibited combinations at the infrastructure level.An agent unable to combine the actions required for exfiltration is not vulnerable to injection attempts seeking that outcome, regardless of model behavior.
  • Authorization architecture: APC operationalizes this view as a session-scoped authorization model for delegated tool use.The model is named the Agentic Principal Chain.
  • Formal guarantees: Composition soundness and blast-radius monotonicity hold for implementations faithful to APC under its stated, explicit assumptions.These are identified as two structural results of the model.
  • Evaluation: 0% observed exfiltration attack success spanned all four AgentDojo domains and InjecAgent’s 544 data-stealing cases across 3,154 evaluation instances.The evaluation included public benchmarks, live LLM evaluation, and adversarial testing under full model compromise.
  • Evaluation: −8.6 pp was the reported interactive utility cost accompanying the observed exfiltration result.The passage reports this figure as an interactive utility cost.

A Restriction Authoring Procedure

The paper formalizes restriction authoring as a four-step procedure that enumerates actions, identifies prohibited outcomes, maps outcomes to restrictions, and verifies coverage. In AgentDojo, seven pairwise and eight k-tuple restrictions achieved coverage 1.0 relative to prohibited outcomes.

  • A Restriction Authoring Procedure: Restriction authoring follows four steps: action-class enumeration, prohibited-outcome identification, outcome-to-restriction mapping, and coverage verification.Each tool maps to exactly one semantic action class, prohibited outcomes receive severity classifications, and restrictions derive from minimal action sequences producing each outcome.
  • A Restriction Authoring Procedure: 7 pairwise and 8 k-tuple restrictions produced coverage 1.0 in the AgentDojo workspace evaluation.Coverage is measured relative to the prohibited-outcome set O, not all possible harmful sequences.

B Adaptive Attack Details

The adaptive-attack evaluation covers twenty-three named attacks with forty-three variants targeting all six conditions, with Table 13 presenting a representative subset. Examples include cross-session token replay, envelope forgery and tampering, delegation-depth overflow, and intent warn-versus-strict behavior.

  • B Adaptive Attack Details: Twenty-three named attacks with 43 variants target all six conditions in the representative adaptive-attack subset.Table 13 summarizes representative outcomes from this attack set.
  • B Adaptive Attack Details: Cross-Session Token (T3) replays a session-A token in session-B.This attack targets cross-session delegation security.
  • B Adaptive Attack Details: Envelope Forgery (T2) signs an envelope with the wrong key, while Envelope Tampering (T2) modifies sealed-envelope scope.These attacks target envelope authenticity and integrity.
  • B Adaptive Attack Details: Depth Overflow acts beyond the delegation-depth ceiling, and Intent Warn Mode tests out-of-intent behavior in warn versus strict mode.The listed attacks probe delegation limits and intent-enforcement modes.

C Mechanism-Class Comparison · D Implementation Details · E Reference Schemas and Validation Semantics

The paper compares APC’s action-class composition closure with sensitivity-based flow tracking, then specifies reproducible enforcement measurements and validation rules. Its reference schemas bind delegated scope, approvals, evidence, budgets, and session history into fail-closed decisions.

  • C Mechanism-Class Comparison: APC and SEAgent-style sensitivity tracking are compared as deterministic static policy checkers on the same InjecAgent and ASB cases.The SEAgent simulation uses a session-level sensitivity high-water mark and denies sensitive-data flows to external sinks.
  • D Implementation Details: The reference implementation provides executable Python 3.11 tests aligned with all formal properties.This establishes an executable validation basis for the paper’s formal guarantees.
  • D Implementation Details: Latency measurements used an Intel Core i5-1245U system running Windows 11, CPython 3.11.9, with 16 GB RAM and no significant competing load.The processor is described as mobile-class, and measurements were singlethreaded.
  • D Implementation Details: Each component was timed over 20,000 calls after 500 warmups, with nearest-rank percentiles and medians across five repetitions.Admissibility timings include all six conditions, evidence commit, composition recording, and budget consumption.
  • D Implementation Details: The reported sub-millisecond enforcement figures characterize the admit path under no load, not performance under contention.Both admissibility rows execute all six conditions and differ only in Condition 4’s impact-score scenario; committed in-protocol values are reported.
  • D Implementation Details: The 99 delegation-chain scenarios cover escalation, exhaustion, cross-hop composition, identity and approval binding, evidence failures, intent binding, and validation edge cases.Coverage also includes k-tuple and cross-domain composition, sensitivity escalation, expired envelopes, and conjunctive-predicate validation.
  • D Implementation Details: Domain configurations were sanity-checked before final evaluation, correcting implementation defects and invalid policies while preserving genuine tradeoffs.All corrections were applied before results were frozen.
  • E Reference Schemas and Validation Semantics: Authorization envelopes and approval tokens cryptographically bind delegated scope and exact actions, while nine rules enforce fail-closed, conjunctive, temporal, budget, evidence, and session-history semantics.Narrowed envelopes restrict resources, actions, and data classifications to the parent scope while preserving or strengthening composition prohibitions; approval tokens are single-use, SHA-256-bound, non-replayable, and atomically decremented.

F Comparison Tables · G Impact Calibration · H Blast-Radius Calibration

The paper compares APC’s property coverage with existing authorization mechanisms, calibrates impact scores through expert, Bayesian, and sensitivity methods, and defines blast-radius scores and non-increasing delegation ceilings.

  • F Comparison Tables: Table 16 reports standalone coverage of APC properties by existing authorization mechanisms.
  • F Comparison Tables: Table 17 compares APC with modern agentic security systems.
  • F Comparison Tables: Existing guarantees and policy updates do not provide per-hop scope attenuation or cumulative budget inheritance along a delegation chain.The cited discussion conditions one formal guarantee on completeness of X_eff and distinguishes temporal policy behavior from structural delegation controls.
  • G Impact Calibration: Impact weights and threshold are calibrated using expert elicitation, Bayesian estimation, and sensitivity analysis.Expert rankings target Kendall’s τ ≥ 0.8; sensitivity analysis selects θ for false-autonomous rate < 1% and approval burden < 15%.
  • H Blast-Radius Calibration: Each resource receives a deployment-time blast(r) score in [0, 1] based on scope, irreversibility, and data sensitivity.
  • H Blast-Radius Calibration: Default blast-radius weights are w_s = 0.4, w_v = 0.4, and w_d = 0.2.The weights sum to one, remain nonnegative, and satisfy monotonicity when one resource dominates another on all three factors.
  • H Blast-Radius Calibration: Delegation attenuates the session ceiling β_max at every hop, with the conservative default β_max(p_i) = 0.7 · β_max(p_i−1).Theorem 4.6 requires consistent blast(r) values and a non-increasing β_max; specific values affect only bound tightness.
Loading 2608.15888v1…