Bounded Agents: Delegation Security for Multi-Agent AI Systems

Xabier Muruaga

cs.AIAug 16, 2026

Bounded Agents: Delegation Security for Multi-Agent AI Systems

Authors: Xabier Muruaga

Organizations: Independent Researcher

Abstract

LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.

Figures & tables

ID	Adversary capability
A1	Inject content into the agent’s context via untrusted data sources (indirect prompt injection)
A2	Fully compromise a single principal in the chain (sub-agent, tool server, or orchestrator)
A3	Observe which actions succeed or fail to probe scope boundaries
A4	Maintain influence for the duration of a task session

Table 1. Adversary capabilities.

ID	Trust boundary
T1	Compromise the PDP, PEP, evidence sink, or key-management infrastructure
T2	Forge cryptographic signatures or hashes
T3	Operate across session boundaries

Table 2. Trust boundaries (capabilities the adversary does not have).

ID	Guarantee	Enforced by
G1	No action outside scope $S(p_{i})$ executes	Condition 2a
G2	No prohibited action pair co-occurs in a session; $k$ -tuple restrictions extend this to ordered subsequences	Condition 2b, Thm. 4.8 , Prop. 4.9
G3	Blast radius does not increase at each delegation hop	Thm. 4.6
G4	High-impact actions require valid approval tokens	Condition 4
G5	Every admitted action is coupled to infrastructure-generated evidence, or execution is denied	Condition 5
G6	Actions outside declared intent are denied or flagged	Condition 6

Table 3. Security goals and the mechanisms that enforce them.

Panel of Figure 1 — Figure 1. Delegation chain with scope narrowing ( $\sqcap$ ) at each hop (blue). Infrastructure enforcement (orange): the PDP evaluates six admissibility conditions before the PEP permits execution. The PEP commits tamper-evident evidence to an append-only store; if the store is unreachable, the action is denied (C5). Architecture diagram showing a delegation chain from Human Principal p0 through Orchestrator p1 to Sub-Agent p2, with scope restricting at each hop. The sub-agent connects to a Policy Decision Point that evaluates six admissibility conditions before the Enforcement Point permits tool execution.

Panel of Figure 2 — Figure 2. Composition closure distinguishes legitimate workflows from attacks. Top: reading then sharing internally is admitted. Middle: direct exfiltration is blocked by pairwise restriction. Bottom: staged exfiltration via an intermediate write evades pairwise but is caught by $k$ -tuple restriction. Three-row diagram showing how composition closure works.

Panel of Figure 3 — Figure 3. Compromised-model evaluation by attack type, pooled across all four AgentDojo domains (609 task–injection pairs). Exfiltration is eliminated by composition closure (C2b); destruction and manipulation are reduced by intent binding (C6). Vertical bar chart showing attack success rates by type. Exfiltration drops from 87% to 0%, destruction from 39% to 4%, manipulation from 90% to 12%.

Panel of Figure 4 — Figure 4. Static deterministic benchmarks: InjecAgent (1,054 cases) and ASB (400 cases). Data-stealing and disruptive attacks are blocked completely; residual direct-harm attacks (single-action within scope) and stealthy attacks (action-type granularity) lie outside APC’s design boundary. Vertical bar chart showing static benchmark results. Data stealing and disruptive drop from 100% to 0%. Direct harm remains at 60% and stealthy at 30%.

Condition	Data Stealing ASR	Direct Harm ASR	Total ASR
Baseline	100.0%	100.0%	100.0%
Complete $X$	0.0%	60.4%	29.2%
Partial $X$	39.9%	82.0%	60.2%

Table 4. InjecAgent results (1,054 test cases). ASR = attack success rate (lower is better).

Condition	Stealthy ASR	Disruptive ASR	Total ASR
Baseline	100.0%	100.0%	100.0%
Complete $X$	30.0%	0.0%	15.0%
Partial $X$	60.0%	100.0%	80.0%

Table 5. ASB results (400 attack tools, 10 scenarios). ASR = attack success rate.

Domain	Tools	Action Cls.	Pairwise	$k$ -tuple	Resources
Workspace	32	8	7	8	5
Banking	13	6	5	3	5
Travel	28	7	3	4	7
Slack	11	6	3	2	4
InjecAgent	—	9	8	0	—
ASB	—	7	9	0	—

Table 6. Per-domain authoring burden.

Suite	Baseline	Strict	Inter.	$\Delta$ strict (pp)	$\Delta$ inter. (pp)
Workspace (560)	96.2 $\pm$ 0.2%	81.5 $\pm$ 0.1%	86.7 $\pm$ 0.4%	$-$ 14.7	$-$ 9.6
Banking (144)	68.8 $\pm$ 1.2%	50.0 $\pm$ 0.7%	58.8 $\pm$ 1.7%	$-$ 18.8	$-$ 10.0
Travel (140)	59.8 $\pm$ 1.1%	55.7 $\pm$ 0.7%	60.0 $\pm$ 1.4%	$-$ 4.0	$+$ 0.2
Slack (105)	73.0 $\pm$ 1.5%	56.5 $\pm$ 5.2%	60.0 $\pm$ 4.4%	$-$ 16.5	$-$ 13.0

Table 7. Utility preservation on four AgentDojo suites (Claude Sonnet 4.6). UPR = fraction of task–injection pairs where the user task is completed successfully. Values are means over 3 runs;

\pm

denotes sample standard deviation.

\Delta

columns report percentage-point differences computed from unrounded means.

Suite / Category	Attack Tools	No Def.	APC	Blocking
Workspace (240 pairs)
Exfiltration	send_email	90.0%	0.0%	C2b + C4 + C6
Destruction	delete_file/email	48.8%	5.0%	C6 (intent)
Manipulation	create_calendar	97.5%	30.0%	C6 (partial)
Banking (144 pairs)
Financial exfil.	send_money	75.0%	0.0%	C2b (formal)

Table 8. Compromised-model evaluation on four AgentDojo suites (Claude Haiku 4.5). Ground-truth attack injection simulates a fully compromised model. Total: 609 unique task–injection pairs, 1,218 executions.

Category	Attack Tool	Cases	Root Cause
Intent overlap	create_calendar_event	12	write class matches task intent
Intent overlap	update_sched_transaction	2	write class matches task intent
Missing pair in $X$	delete_file	4	( read , delete ) $\notin X$
Total		18

Table 9. Taxonomy of residual attack successes (18 of 609 runs, 3.0% aggregated observed ASR).

Benchmark	Cases	Type	Main outcome
Delegation chains	99	Multi-hop (2–8 hops)	99/99, all 6 conditions
InjecAgent	1,054	Public	Data stealing 0%
ASB	400	Public	Disruptive 0%
AgentDojo (utility)	949	Live LLM, 4 suites	$\Delta$ interactive $-$ 8.6 pp (mean, 3 runs)
AgentDojo (compromised)	609 †	Compromised-model	Exfil 0% all suites
Adaptive	43	Self-designed	23/23 matched

Table 10. Evaluation coverage across all benchmarks (3,154 evaluation instances). The compromised-model and utility cohorts are drawn from the same AgentDojo task–injection space and are therefore not disjoint.

Attack class	Coverage	Main mechanism	Residual
Multi-step exfiltration	Full	C2b composition closure	0%
Delegation priv. escalation	Full	Thm. 4.6	0%
Destruction (out-of-intent)	High	C6 intent binding	4%
Manipulation (in-intent)	Partial	C6 (action-type granularity)	12.1%
Single-action within scope	None	Outside APC boundary	60.4%
Parameter-level misuse	None	Requires param. validation	—

Table 11. Attack-class coverage summary. Residual values are observed ASR.

Property	Assumption	Guarantee	Evidence
Blast-radius mono. (Thm. 4.6 )	Scope narrowing; cumulative budget tracking; consistent $\mathrm{blast}(r)$	Reachable blast radius non-increasing per hop	99 chain scenarios (depths 2–8)
Comp. soundness (Thm. 4.8 , Prop. 4.9 )	Complete $X_{\mathrm{eff}}$ , $K$ ; serialized admission	No admissible sequence produces prohibited outcome	InjecAgent 0% DS; ASB 0% disruptive; adaptive all matched

Table 12. Formal results: assumptions, guarantees, and supporting evidence.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Attack	Strategy	Result
Decomposed Exfil	read $\to$ write $\to$ send_internal (evades pairwise)	blocked ( $k$ -tuple)
Intent Drift	in-scope, out-of-intent resource	blocked (C6)
Budget Exhaustion	3 transfers, budget max 2	blocked (C2c)
Approval Replay	reuse token with different parameters	blocked (C4 hash)
Expired Token	use approval token after TTL expires	blocked (C4 temporal)
Consumed Token	reuse single-use token after consumption	blocked (C4 single-use)

Appendix

Table 13. Adaptive attack results (representative subset). Twenty-three named attacks with 43 variants target all six conditions.

Mechanism	DS	DH	Total	Stlth.	Disr.	Class
	InjecAgent			ASB
Comp. closure (APC)	0.0%	60.4%	29.2%	30.0%	0.0%	Action-class pairs
Info flow (SEAgent sim.)	1.7%	59.2%	29.5%	60.0%	60.0%	Sensitivity labels

Appendix

Table 14. Enforcement mechanism comparison on InjecAgent (1,054 cases) and ASB (400 cases).

Component	p50 (ms)	p99 (ms)
Full admissibility, C4 below threshold	0.049 [0.048–0.050]	0.240 [0.173–0.261]
Full admissibility, C4 token verified	0.057 [0.056–0.058]	0.236 [0.215–0.345]
Composition closure (isolated)	0.0016 [0.0012–0.0021]	0.0031 [0.0016–0.0033]
Envelope narrowing (meet + re-sign)	0.015 [0.015–0.016]	0.059 [0.049–0.081]

Appendix

Table 15. Enforcement latency on the environment above. Median of five repetitions; bracketed values are the range across repetitions. Reproduced from the committed measurement artifact evals/latency/results/latency_appendix_d.json .

Property	OAuth+OPA	Prompts	Static Manifest	APC
Scope enforcement (G1)	✓	—	—	✓
Scope attenuation	Partial	—	Tool-level	✓
Composition closure (G2)	—	—	—	✓
Blast-radius mono. (G3)	—	—	—	✓
Approval binding (G4)	—	—	—	✓
Evidence commit. (G5)	Partial	—	—	✓

Appendix

Table 16. Standalone coverage of APC properties by existing authorization mechanisms.

Property	SEAgent	CaMeL	Progent	APC
Data stealing ASR	0% a	—	—	0%
Composition closure	Policy-dep.	Dataflow-dep.	Policy-dep.	Formal b
Blast-radius mono.	—	—	Temporal c	Structural
Multi-hop delegation	Partial	—	Partial c	✓
Intent binding	—	—	—	✓

Appendix

Table 17. APC versus modern agentic security systems.

Resource	$\mathrm{scope}$	$\mathrm{irrev}$	$\mathrm{sens}$	$\mathrm{blast}$	Rationale
User calendar entry	0.1	0.2	0.1	0.14	Single user, recoverable, low sensitivity
Shared team document	0.4	0.3	0.6	0.40	Team scope, versioned, confidential
Customer PII record	0.6	0.7	1.0	0.72	Broad scope, hard to remediate, restricted
Production database	0.9	0.9	0.8	0.88	Org-wide, near-irreversible, restricted
External email send	0.7	1.0	0.5	0.78	Unrecallable, broad reach, variable sensitivity

Appendix

Table 18. Illustrative blast scores under default weights.

Explore similar work

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems
Aug 31, 2026Panduranga Sai Varma Dantuluri, Jyotirmoy SundiMulti-Agent LLM Systems LLM Agent Security
VotalAI
MiniScope: Authorizing Agents with Least-Privilege Permissions
Dec 11, 2025Jinhao Zhu, Xiao Huang, Kevin Tseng +4Tool Access Control for LLM Agents AI Agent Security
UC Berkeley · IBM Research
Agent-Sentry: Bounding LLM Agents via Execution Provenance
Mar 24, 2026Rohan Sequeira, Stavros Damianakis, Umar Iqbal +1AI Agent Security AI Agent Monitoring
University of Southern California, Los Angeles, California, USA · Washington University in St. Louis, St. Louis, Missouri, USA

Aug 31, 2026J/K move · Enter open · S save

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems

Panduranga Sai Varma Dantuluri, Jyotirmoy Sundi

VotalAI

Multi-Agent LLM Systems LLM Agent Security AI Agent Governance Tool Access Control for LLM Agents

Open paper AskPDF arXiv

Autonomous LLM agents increasingly act on a user's behalf: they hold credentials, call tools and services, and spawn sub-agents that act further on their behalf. This turns a long-standing distributed-systems question -- who is authorized to do what, on whose authority -- into an urgent and largely unsolved problem, because the component driving each agent is a language model an adversary can hijack. We argue that agent security must be evaluated under an untrusted-model assumption: a correct system is one in which a fully prompt-injected agent still cannot exceed the authority explicitly delegated to it. Against this standard we make three contributions. First, we give a threat model for multi-agent delegation centered on four adversaries -- confused deputy, token theft and replay, prompt-injection privilege escalation, and compromised sub-agents -- and derive eight security requirements a governed agent system must meet. Second, we show the gap is real: a default agent runtime modeling common practice (broad bearer credentials, authorization gated inside the model) fails all four threats, and across four widely used frameworks -- LangGraph, CrewAI, AutoGen, and the Model Context Protocol (MCP) authorization model -- three provide no built-in confinement and one only partial; no existing standard alone covers the requirement set. Third, we implement and adversarially evaluate an authorization broker that closes the gap. It blocks all four threats; it resists 11 direct attacks on its design and accepts 0 of 200,000 forged tokens; it confines a compromised sub-agent to its delegated task (a mean of 1.5 reachable actions versus all 8,100 under bearer delegation, across 2,000 randomized scenarios); and it enforces at microsecond cost (about 2.6 microseconds per decision), negligible against model inference. These principles are also realized in production in VotalAI's LLM Shield.

Abstract

Explore similar work

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems

MiniScope: Authorizing Agents with Least-Privilege Permissions

Agent-Sentry: Bounding LLM Agents via Execution Provenance