SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems

KrishnaSaiReddy Patil

cs.CRApr 3, 2026

SentinelAgent: Intent-Verified Delegation Chains for Securing Federal Multi-Agent AI Systems

Authors: KrishnaSaiReddy Patil

Abstract

When Agent A delegates to Agent B, which invokes Tool C on behalf of User X, no existing framework can answer: whose authorization chain led to this action, and where did it violate policy? This paper introduces SentinelAgent, a formal framework for verifiable delegation chains in federal multi-agent AI systems. The Delegation Chain Calculus (DCC) defines seven properties - six deterministic (authority narrowing, policy preservation, forensic reconstructibility, cascade containment, scope-action conformance, output schema conformance) and one probabilistic (intent preservation) - with four meta-theorems and one proposition establishing the practical infeasibility of deterministic intent verification. The Intent-Preserving Delegation Protocol (IPDP) enforces all seven properties at runtime through a non-LLM Delegation Authority Service. A three-point verification lifecycle achieves 100% combined TPR at 0% FPR on DelegationBench v4 (516 scenarios, 10 attack categories, 13 federal domains). Under black-box adversarial conditions, the DAS blocks 30/30 attacks with 0 false positives. Deterministic properties are unbreakable under adversarial stress testing; intent verification degrades to 13% against sophisticated paraphrasing. Fine-tuning the NLI model on 190 government delegation examples improves P2 from 1.7% to 88.3% TPR (5-fold cross-validated, F1=82.1%). Properties P1, P3-P7 are mechanically verified via TLA+ model checking across 2.7 million states with zero violations. Even when intent verification is evaded, the remaining six properties constrain the adversary to permitted API calls, conformant outputs, traceable actions, bounded cascades, and compliant behavior.

Figures & tables

ID	Adversary	Capability	Citation
A1	External	Prompt injection	[ 10 ]
A2	Compromised Agent	Controls one agent	[ 11 ]
A3	Man-in-the-Middle	Intercepts messages	[ 13 ]
A4	Privilege Escalator	Exploits delegation	[ 14 ]
A5	Chain Poisoner	Subtle intent drift	[ 12 ]
A6	Collusive Agents	Two+ agents coordinate via side channel	[ 30 ]

TABLE I: Adversary Types and Real-World Attack Mappings

ID	Adversary	P1	P2	P4	P5	P6	P7
A1	External (injection)		✓			✓	✓
A2	Compromised Agent	✓	✓	✓	✓	✓	✓
A3	Man-in-the-Middle			✓
A4	Privilege Escalator	✓				✓
A5	Chain Poisoner		✓	✓			✓
A6	Collusive Agents			✓	✓	✓	✓

TABLE II: Adversary

\to

Property Defense Coverage

Panel of Figure 3 — Fig. 1: DAS architecture and three-point verification lifecycle. P2 checks intent before delegation, P6 enforces the API manifest at execution, P7 validates output after execution. All checks route through the DAS.

Panel of Figure 4 — Fig. 2: Delegation chain walkthrough. Scope narrows at each step (P1). P6 blocks unauthorized API calls; P7 blocks malicious output types from permitted calls. P4 hash linking enables forensic reconstruction.

Control	Name	Agent Interpretation	DCC
AC-2	Account Mgmt	Agent lifecycle via DAS registry	P1
AC-3	Access Enforcement	Agent action authorization	P1
AC-4	Info Flow	No PII to low-trust agent	P1
AC-5	Separation of Duties	$\geq$ 2 agents for HIGH ops	P1
AC-6	Least Privilege	Minimum scope per subtask	P1
AC-17	Remote Access	Cross-agency encrypted deleg.	P3

TABLE III: NIST 800-53

\to

Agentic AI Delegation Mapping (20 Controls)

ASI	Risk	DCC Property	Coverage
ASI01	Goal Hijacking	P2 (Intent)	PARTIAL
ASI02	Tool Misuse	P1+P6	FULL
ASI03	Privilege Escalation	P1	FULL
ASI04	Uncontrolled Autonomy	P5+P6	FULL
ASI05	Cascading Hallucination	P5	FULL
ASI06	Memory Poisoning	P4+P6	DETECT+PREVENT

TABLE IV: OWASP ASI

\to

DCC Property Mapping

Cat	Description	N	Prop.	Example
A	Keyword-detectable drift	20	P2+P6	exfiltrate records
B	Paraphrase + unauth. API	20	P6	compile outreach data
C	Permitted API + bad output	20	P7	query $\to$ denial
D	Subtle scope violations	20	P6	adjacent endpoint
E	Benign (13 domains)	156	FPR	standard operations
F	Cross-scope lateral move	30	P6	read $\to$ write API

TABLE V: DelegationBench v4 Attack Taxonomy

Configuration	Attack TPR	Benign FPR	Accuracy
No Defense	0.0%	0.0%	70.9%
P2 (off-the-shelf NLI)	13.3%	0.0%	74.6%
P2 (fine-tuned NLI)	88.3%	0.0%	96.6%
P6 Only	86.7%	0.0%	96.1%
P7 Only	13.3%	0.0%	74.6%
P6+P7	100.0%	0.0%	100.0%

TABLE VI: Three-Point Verification on DelegationBench v4 (516 scenarios, 150 attacks, 366 benign)

Cat	Attack Type	N	TPR	Caught By
A	Keyword-detectable drift	20	100%	P2+P6
B	Paraphrase + unauth. API	20	100%	P6
C	Permitted API + bad output	20	100%	P7
D	Subtle scope violations	20	100%	P6
F	Cross-scope lateral move	30	100%	P6
G	Temporal/replay attacks	20	100%	P6

TABLE VII: Per-Category Detection on DelegationBench v4

Evaluation	Attacks	Benign	TPR	FPR
Black-box red team	30	10	100%	0%
Independent red team	45	14	100%	0%
DAS robustness	29	—	100%	—
LLM agent (real DAS)	5	23	100%	0%
Live LangChain agent	10	10	100%	0%
Combined	119	57	100%	0%

TABLE VIII: Adversarial Evaluation Summary

Feature	SE	Shield	ABC	FASA	AIP	AW	FJ	Ours
Multi-agent chains	✗	✗	✗	Part.	✓	✓	✗	✓
Authority narrowing	✓	✗	✗	✗	✓	✗	✗	✓
Intent preservation	✗	✗	Drift	✗	✗	✗	✗	✓
Scope-action (P6)	✗	✗	✗	✗	✗	Part.	✗	✓
Output valid. (P7)	✗	✗	✗	✗	✗	✗	✗	✓
Formal proofs	Part.	✗	✓	✗	✗	✗	✓	✓

TABLE IX: Comparison with Existing Agent Security Frameworks

Explore similar work

Bounded Agents: Delegation Security for Multi-Agent AI Systems
Aug 16, 2026Xabier MuruagaAI Agent Security Runtime Enforcement for AI Agents
Independent Researcher
AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A
Mar 25, 2026Sunil PrakashAI Agent Security Tool Access Control for LLM Agents
Indian School of Business, India
HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems
Apr 6, 2026Asiri DalugodaAI Accountability Multi-Agent System Security
Helixar Limited, Auckland, New Zealand

Aug 16, 2026J/K move · Enter open · S save

Bounded Agents: Delegation Security for Multi-Agent AI Systems

Xabier Muruaga

Independent Researcher

AI Agent Security Runtime Enforcement for AI Agents Tool Access Control for LLM Agents Multi-Agent System Security

Open paper AskPDF arXiv

LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.

Abstract

Explore similar work

Bounded Agents: Delegation Security for Multi-Agent AI Systems

AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A

HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems