Everything K-culture — comebacks to K-beauty, straight to your inboxGet it in your inbox›
Bounded Agents: Delegation Security for Multi-Agent AI Systems
arXiv:2608.158882026-08-15
Stopping AI agents from combining allowed actions into forbidden outcomes, by fixing the permission system instead of the model
LLM-based AI agents get their permissions fixed at the start of a session and each request is checked in isolation, which lets an agent chain together individually permitted actions into something harmful, like reading a confidential file and then emailing it out. The author proposes APC (Agentic Principal Chain), a permission-tracking system that narrows authority at every delegation step and checks each new request against everything the agent has already done, backed by mathematical proofs. Tested even under a fully compromised model, APC cut AgentDojo's data-exfiltration success rate from as high as 100% down to 0% and blocked all 544 data-theft attempts in InjecAgent.
METAL MEDIA explanatory visual
Stopping AI agents from combining allowed actions into forbidden outcomes, by fixing the permission system instead of the model
01The paper argues the real risk of prompt injection (hidden malicious instructions smuggled into an AI's input) isn't just whether the model gets fooled, but whether the agent even has the authority to cause harm in the first place.
02APC tracks a chain of delegation from user to orchestrator to sub-agent to tool, shrinking permissions at every hop and keeping a running record of prior actions, then checks every new request against six conditions.
03A mechanism called 'composition closure' bans specific dangerous combinations of individually harmless actions in advance, such as reading a confidential document then sending an external email.
04The authors mathematically prove two properties: that an agent's potential damage ('blast radius') can only shrink, never grow, as authority is delegated further, and that forbidden action combinations can never occur if the ban list is complete.
05In a worst-case test simulating a fully compromised model, exfiltration attacks succeeded 0% of the time across all four AgentDojo domains and all 544 InjecAgent data-theft cases were blocked, destructive actions dropped from 38.6% to 4.0%, manipulative actions dropped from 90.5% to 12.1%, and the permission check itself took only 0.24 milliseconds.
An explanatory diagram made by METAL MEDIA, not a figure supplied by the paper's authors.
What they did
The paper argues the real risk of prompt injection (hidden malicious instructions smuggled into an AI's input) isn't just whether the model gets fooled, but whether the agent even has the authority to cause harm in the first place.
APC tracks a chain of delegation from user to orchestrator to sub-agent to tool, shrinking permissions at every hop and keeping a running record of prior actions, then checks every new request against six conditions.
A mechanism called 'composition closure' bans specific dangerous combinations of individually harmless actions in advance, such as reading a confidential document then sending an external email.
The authors mathematically prove two properties: that an agent's potential damage ('blast radius') can only shrink, never grow, as authority is delegated further, and that forbidden action combinations can never occur if the ban list is complete.
In a worst-case test simulating a fully compromised model, exfiltration attacks succeeded 0% of the time across all four AgentDojo domains and all 544 InjecAgent data-theft cases were blocked, destructive actions dropped from 38.6% to 4.0%, manipulative actions dropped from 90.5% to 12.1%, and the permission check itself took only 0.24 milliseconds.
Table 1. Adversary capabilities.
ID
Adversary capability
A1
Inject content into the agent’s context via untrusted data sources (indirect prompt injection)
A2
Fully compromise a single principal in the chain (sub-agent, tool server, or orchestrator)
A3
Observe which actions succeed or fail to probe scope boundaries
A4
Maintain influence for the duration of a task session
Table 2. Trust boundaries (capabilities the adversary does not have).
ID
Trust boundary
T1
Compromise the PDP, PEP, evidence sink, or key-management infrastructure
T2
Forge cryptographic signatures or hashes
T3
Operate across session boundaries
Table 3. Security goals and the mechanisms that enforce them.
ID
Guarantee
Enforced by
G1
No action outside scope S(pi) executes
Condition 2a
G2
No prohibited action pair co-occurs in a session; k-tuple restrictions extend this to ordered subsequences
Condition 2b, Thm. 4.8, Prop. 4.9
G3
Blast radius does not increase at each delegation hop
Thm. 4.6
G4
High-impact actions require valid approval tokens
Condition 4
G5
Every admitted action is coupled to infrastructure-generated evidence, or execution is denied
Condition 5
G6
Actions outside declared intent are denied or flagged
Condition 6
Table 4. InjecAgent results (1,054 test cases). ASR = attack success rate (lower is better).
Table 7. Utility preservation on four AgentDojo suites (Claude Sonnet 4.6). UPR = fraction of task–injection pairs where the user task is completed successfully. Values are means over 3 runs; ± denotes sample standard deviation. Δ columns report percentage-point differences computed from unrounded means.
Suite
Baseline
Strict
Inter.
Δ strict (pp)
Δ inter. (pp)
Workspace (560)
96.2±0.2%
81.5±0.1%
86.7±0.4%
−14.7
−9.6
Banking (144)
68.8±1.2%
50.0±0.7%
58.8±1.7%
−18.8
−10.0
Travel (140)
59.8±1.1%
55.7±0.7%
60.0±1.4%
−4.0
+0.2
Slack (105)
73.0±1.5%
56.5±5.2%
60.0±4.4%
−16.5
−13.0
Table 8. Compromised-model evaluation on four AgentDojo suites (Claude Haiku 4.5). Ground-truth attack injection simulates a fully compromised model. Total: 609 unique task–injection pairs, 1,218 executions.
Suite / Category
Attack Tools
No Def.
APC
Blocking
Workspace (240 pairs)
Exfiltration
send_email
90.0%
0.0%
C2b + C4 + C6
Destruction
delete_file/email
48.8%
5.0%
C6 (intent)
Manipulation
create_calendar
97.5%
30.0%
C6 (partial)
Banking (144 pairs)
Financial exfil.
send_money
75.0%
0.0%
C2b (formal)
Manipulation
update_sched_txn
87.5%
12.5%
C6 (partial)
Account takeover
update_password
87.5%
0.0%
C2b (formal)
Travel (120 pairs)
Exfiltration
send_email
90.0%
0.0%
C2b (formal)
Manipulation
reserve/calendar
86.7%
0.0%
C6 (no overlap)
Slack (105 pairs)
Ext. exfiltration
post_webpage
100.0%
0.0%
C2b (formal)
Int. exfiltration
send_direct_msg
100.0%
0.0%
k-tuple
Destruction
remove_user
0.0%
0.0%
— (attack fails undefended)
Reconnaissance
get_webpage
100.0%
0.0%
C6 (intent)
Table 9. Taxonomy of residual attack successes (18 of 609 runs, 3.0% aggregated observed ASR).
Category
Attack Tool
Cases
Root Cause
Intent overlap
create_calendar_event
12
write class matches task intent
update_sched_transaction
2
write class matches task intent
Missing pair in X
delete_file
4
(read, delete) ∉X
Total
18
Table 10. Evaluation coverage across all benchmarks (3,154 evaluation instances). The compromised-model and utility cohorts are drawn from the same AgentDojo task–injection space and are therefore not disjoint.
Benchmark
Cases
Type
Main outcome
Delegation chains
99
Multi-hop (2–8 hops)
99/99, all 6 conditions
InjecAgent
1,054
Public
Data stealing 0%
ASB
400
Public
Disruptive 0%
AgentDojo (utility)
949
Live LLM, 4 suites
Δ interactive −8.6 pp (mean, 3 runs)
AgentDojo (compromised)
609†
Compromised-model
Exfil 0% all suites
Adaptive
43
Self-designed
23/23 matched
†609 unique pairs, 1,218 total executions under two conditions.
Table 11. Attack-class coverage summary. Residual values are observed ASR.
Attack class
Coverage
Main mechanism
Residual
Multi-step exfiltration
Full
C2b composition closure
0%
Delegation priv. escalation
Full
Thm. 4.6
0%
Destruction (out-of-intent)
High
C6 intent binding
4%
Manipulation (in-intent)
Partial
C6 (action-type granularity)
12.1%
Single-action within scope
None
Outside APC boundary
60.4%
Parameter-level misuse
None
Requires param. validation
—
Table 12. Formal results: assumptions, guarantees, and supporting evidence.
No admissible sequence produces prohibited outcome
InjecAgent 0% DS; ASB 0% disruptive; adaptive all matched
Table 13. Adaptive attack results (representative subset). Twenty-three named attacks with 43 variants target all six conditions.
Attack
Strategy
Result
Decomposed Exfil
read → write → send_internal (evades pairwise)
blocked (k-tuple)
Intent Drift
in-scope, out-of-intent resource
blocked (C6)
Budget Exhaustion
3 transfers, budget max 2
blocked (C2c)
Approval Replay
reuse token with different parameters
blocked (C4 hash)
Expired Token
use approval token after TTL expires
blocked (C4 temporal)
Consumed Token
reuse single-use token after consumption
blocked (C4 single-use)
Evidence Evasion
act when evidence sink is down
blocked (C5 fail-closed)
Scope Probing (A3)
probe resources, actions, classifications
boundaries enforced
Gradual Buildup (A4)
8-step sequence with interleaved noise
blocked (pair + k-tuple)
Session Splitting
split read/send across sessions
admitted (per-session)
Cross-Session Token (T3)
replay session-A token in session-B
blocked (C4 session)
Envelope Forgery (T2)
sign envelope with wrong key
blocked (signature)
Envelope Tampering (T2)
modify sealed envelope scope
blocked (immutability)
Depth Overflow
act beyond delegation depth ceiling
blocked (C2c)
Intent Warn Mode
out-of-intent in warn vs strict mode
graduated enforcement
Table 14. Enforcement mechanism comparison on InjecAgent (1,054 cases) and ASB (400 cases).
InjecAgent
ASB
Mechanism
DS
DH
Total
Stlth.
Disr.
Class
Comp. closure (APC)
0.0%
60.4%
29.2%
30.0%
0.0%
Action-class pairs
Info flow (SEAgent sim.)
1.7%
59.2%
29.5%
60.0%
60.0%
Sensitivity labels
Table 15. Enforcement latency on the environment above. Median of five repetitions; bracketed values are the range across repetitions. Reproduced from the committed measurement artifact evals/latency/results/latency_appendix_d.json.
Component
p50 (ms)
p99 (ms)
Full admissibility, C4 below threshold
0.049 [0.048–0.050]
0.240 [0.173–0.261]
Full admissibility, C4 token verified
0.057 [0.056–0.058]
0.236 [0.215–0.345]
Composition closure (isolated)
0.0016 [0.0012–0.0021]
0.0031 [0.0016–0.0033]
Envelope narrowing (meet + re-sign)
0.015 [0.015–0.016]
0.059 [0.049–0.081]
Table 16. Standalone coverage of APC properties by existing authorization mechanisms.
Property
OAuth+OPA
Prompts
Static Manifest
APC
Scope enforcement (G1)
✓
—
—
✓
Scope attenuation
Partial
—
Tool-level
✓
Composition closure (G2)
—
—
—
✓
Blast-radius mono. (G3)
—
—
—
✓
Approval binding (G4)
—
—
—
✓
Evidence commit. (G5)
Partial
—
—
✓
Intent binding (G6)
—
—
—
✓
Table 17. APC versus modern agentic security systems.
Property
SEAgent
CaMeL
Progent
APC
Data stealing ASR
0%a
—
—
0%
Composition closure
Policy-dep.
Dataflow-dep.
Policy-dep.
Formalb
Blast-radius mono.
—
—
Temporalc
Structural
Multi-hop delegation
Partial
—
Partialc
✓
Intent binding
—
—
—
✓
Table 18. Illustrative blast scores under default weights.
Resource
scope
irrev
sens
blast
Rationale
User calendar entry
0.1
0.2
0.1
0.14
Single user, recoverable, low sensitivity
Shared team document
0.4
0.3
0.6
0.40
Team scope, versioned, confidential
Customer PII record
0.6
0.7
1.0
0.72
Broad scope, hard to remediate, restricted
Production database
0.9
0.9
0.8
0.88
Org-wide, near-irreversible, restricted
External email send
0.7
1.0
0.5
0.78
Unrecallable, broad reach, variable sensitivity
Why it matters
Most AI agent security work focuses on making the model itself resist bad instructions, but this research shows that redesigning the underlying permission architecture can block attacks regardless of how well the model behaves. As companies increasingly chain multiple AI agents together for real work, having a publicly available implementation and evaluation toolkit makes this immediately relevant for practical deployment.
Terms in this paper
prompt injection · an attack that hides malicious instructions inside documents or data fed to an AI so it takes unintended actions
APC (Agentic Principal Chain) · the permission-tracking system proposed in this paper that follows delegated authority from user to sub-agents to tools and checks every request
composition closure · a rule system that bans specific combinations of otherwise individually-allowed actions
PEP/PDP · Policy Enforcement Point and Policy Decision Point, a separate gatekeeper outside the AI model that actually allows or blocks each action
attack success rate (ASR) · the percentage of attack attempts that actually succeeded; lower means better defense
Original abstract (English)
LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.
