Oleksandr Kuzmenko, EditorPublished 6 min readAI-assisted · editor-reviewed
TL;DR
- Never trust system prompts to prevent unauthorized agent writes or API calls.
- Calculate tool execution authority as the strict intersection of user, agent, and tenant permissions.
- Adopt RFC 8693 OAuth token exchange to enforce delegated on-behalf-of authorization.
Key facts
- Authorization Principle
- User ∩ Agent ∩ Tenant intersection
- Identity Exchange Standard
- OAuth 2.0 Token Exchange (RFC 8693)
- Failure Posture
- Fail closed, deny by default
The Root Cause: Borrowed Authority
When an AI assistant processes untrusted ticket or message bodies, embedded instructions easily steer the model into producing well-formed calls like write to tickets.globex. If the execution layer authorizes calls via a platform service credential, the agent acts as a confused deputy. An attacker merely borrows the delta between the caller's permissions and the platform's overarching privileges.
The Intersection Rule
Effective permission must always equal user ∩ agent ∩ tenant. Every tool call must follow four operational rules:
- Deny by default: An empty permission set denies everything. Any lookup error fails closed instantly.
- Decide at the boundary: Never use system prompts to restrict API calls. System prompts are suggestions to a component the attacker directly interacts with.
- Monotonic scoping: Tasks passed between sub-agents can only narrow privileges across hops. No subsequent hop may expand authority.
- Decision telemetry: Emit structured audit logs for every permit and deny decision alongside matched policy identifiers.
Safe Gateway Pipeline
Every invocation crossing the gateway follows strict verification steps: authenticate workload identity via mutual TLS, verify delegated actor tokens via OAuth Token Exchange (RFC 8693), and bind tenant authority using stored policies rather than request payload arguments.
Try it in 2 minutes
permit(
principal in Acme::Role::"SupportAgent",
action in [Acme::Action::"ReadTicket"],
resource in Acme::Tenant::"AcmeCorp"
) when {
context.user.roles.contains("TicketViewer")
};When to use
- Building multi-tenant agent platforms where LLMs execute external API or database tools on behalf of users.
- Designing multi-agent workflows where parent agents delegate credentials to sub-agents.
What to do today
- Audit tool execution endpoints to remove single shared platform service credentials.
- Implement an authorization gateway checking user, agent, and tenant overlap before dispatching side-effects.
Step names are taken from What to do today.
Step names are taken from What to do today. Audit tool execution endpoints to remove single shared platform service credentials.. Implement an authorization gateway checking user, agent, and tenant overlap before dispatching side-effects.
- Audit tool execution endpoints to remove single shared platform service credentials.
- Implement an authorization gateway checking user, agent, and tenant overlap before dispatching side-effects.