Bounded Agents
Delegation Security for Multi-Agent AI Systems
A formal security architecture for delegated authority in multi-agent AI systems. The Agentic Principal Chain (APC) model enforces six deterministic, infrastructure-level checks before any action executes. If any one fails, the action is denied. The paper proves two properties: compromise damage can only shrink at each delegation hop, and no sequence of individually permitted actions can produce a prohibited outcome.
Core Thesis
Prompt injection is an authorization architecture problem. The reason it's dangerous is not that the model follows a malicious instruction, it's that the model has been given authority to act on it.
The model must be excluded from its own trust boundary. An approval gate in a prompt is not a control; it is a suggestion. An approval gate in a Policy Enforcement Point is a control.
Per-action authorization is structurally insufficient. An agent authorized to read confidential documents and send external email can combine both to exfiltrate data, without violating any individual permission.
Agentic systems must assume breach. Some component will be compromised. The question is how much damage it can cause. Blast radius must be bounded by architecture.
The APC Model
The Agentic Principal Chain formalizes how authority flows from a human through an orchestrator to sub-agents and tools, with scope narrowing at every hop.
When a user delegates a task to an agent, the agent receives a bounded view: only the resources, actions, and data classifications relevant to the task, with certain action combinations explicitly prohibited. This is the Authorization Scope: a tuple of permitted resources, permitted actions, permitted data classifications, and prohibited compositions.
At each delegation hop, the scope narrows: permissions are intersected and restrictions can only accumulate; they can never be removed by a downstream agent. Beyond scope, Delegation Budgets impose six quantitative ceilings: delegation depth, cumulative blast radius, irreversible effects, sensitivity class, cross-domain composition, and compute cost.
The entire enforcement layer (scope computation, budget tracking, evidence generation) is executed by infrastructure, not by the agent. The model is structurally excluded from its own trust boundary.
The Six Conditions
Every time an agent proposes an action, the system evaluates an all-or-nothing check across six conditions. If any one fails, the action is denied. Five of six passing is still a denial.
Who is acting?
The acting agent must be bound to a verifiable identity in the delegation chain.
Is this action within bounds, alone and in combination?
Three subchecks: is the action within the agent's narrowed scope (2a), does it create a prohibited combination with prior actions (2b), and are all budget ceilings respected (2c).
Is this the right session?
Prevents replay attacks: a valid approval from one session cannot be reused in another.
Is this high-impact? Who approved it?
Impact scoring with single-use approval tokens tied to the exact action, parameters, and session.
Can we prove this happened?
If the evidence store is unreachable, the action is denied: no evidence trail means no execution.
Is this relevant to the declared task?
Scope defines what an agent may do; intent defines what it should do, enforced by infrastructure.
Formal Results
Blast Radius Monotonicity
For any delegation chain, compromise damage is bounded by delegation depth.
If an attacker compromises a sub-agent three hops deep, the damage is bounded by the scope and budget at that position, no greater than what its delegating parent could have done.
Composition Soundness
If the composition restriction set covers at least one required action pair for every prohibited outcome, then no sequence of individually permitted actions can produce any prohibited outcome.
Reading confidential data is fine; sending external email is fine; doing both in the same session is exfiltration, and the system blocks it. The guarantee is as strong as the policy.
Intent Binding (Proposition)
Intent only restricts, never widens. An agent authorized to read all confidential documents but tasked with “summarize Q4 contracts” should not be reading the CEO's personnel file, even though it has scope to do so. Intent binding closes the gap between what an agent is authorized to do and what it should do.
Adversary Model
The model assumes partial compromise is inevitable. The question is not whether a component will be compromised, but how much damage it can cause.
- A1Inject content into the agent’s context via untrusted data sources (indirect prompt injection)
- A2Fully compromise a single actor in the chain (sub-agent, tool server, or orchestrator)
- A3Observe which actions succeed or fail to probe scope boundaries
- A4Maintain influence for the duration of a task session
- T1Cannot compromise PDP, PEP, evidence store, or key management infrastructure
- T2Cannot forge cryptographic signatures or hashes
- T3Cannot operate across session boundaries
| ID | Guarantee | Enforced by |
|---|---|---|
| G1 | No action outside scope executes | C2a |
| G2 | No prohibited action pair co-occurs in a session | C2b, Thm 2 |
| G3 | Blast radius does not increase at each delegation hop | Thm 1 |
| G4 | High-impact actions require valid approval tokens | C4 |
| G5 | Every admitted action is coupled to infrastructure-generated evidence or execution failure handling | C5 |
| G6 | Actions outside declared intent are denied or flagged | C6 |
Empirical Validation
Reference implementation in Python validating all formal properties with sub-millisecond enforcement overhead.
| Operation | p50 | p99 |
|---|---|---|
| Full check (6 conditions) | 0.06 ms | 0.44 ms |
| Composition check (50 action types) | 0.007 ms | 0.03 ms |
| Scope narrowing (per delegation hop) | 0.03 ms | 0.24 ms |
Overhead is < 0.5 ms p99, negligible vs. LLM inference (500–5000 ms). Throughput: > 7,000 evaluations/sec.
Evaluation scenarios
Detection rate
False positives
Spanning five categories: data exfiltration via tool composition (3), privilege escalation through scope violation (3), threshold gaming via action decomposition (2), intent drift within authorized scope (2), and legitimate workflows (4). A 15th scenario confirms that when the restriction set is incomplete, the attack path it misses is not blocked, validating that the guarantee depends on policy quality.
How APC Compares
Standalone coverage of each property by existing authorization mechanisms. APC is designed to layer on top of existing infrastructure, not to replace it.
| Property | OAuth+OPA | Prompts | Static Manifest | APC |
|---|---|---|---|---|
| Identity binding | ✓ | – | – | ✓ |
| Scope narrowing | Partial | – | Tool-level | ✓ |
| Composition closure | – | – | – | ✓ |
| Blast radius monotonicity | – | – | – | ✓ |
| Approval binding | – | – | – | ✓ |
| Evidence commitment | Partial | – | – | ✓ |
| Intent binding | – | – | – | ✓ |
| Survives injection (A1) | Partial | – | Partial | Bounded |
| Survives compromise (A2) | Partial | – | Partial | Bounded |
Boundaries
- –The model operates at the authorization layer, not the data validation layer, it controls which actions execute, not whether their parameters are correct.
- –Composition restrictions operate at the action-type level; resource-qualified restrictions are identified as future work.
- –The completeness of the composition restriction set is a policy quality problem, analogous to firewall rule coverage.
- –When no intent specification is provided, the intent check is skipped and the remaining five conditions define the security boundary.
- –The model does not prevent a compromised agent from choosing a suboptimal action within its authorized scope and intent. That is the alignment boundary.