Bounded Agents: Delegation Security for Multi-Agent AI Systems
arXiv:2608.158882026-08-15
Stopping AI agents from combining allowed actions into forbidden outcomes, by fixing the permission system instead of the model
LLM-based AI agents get their permissions fixed at the start of a session and each request is checked in isolation, which lets an agent chain together individually permitted actions into something harmful, like reading a confidential file and then emailing it out. The author proposes APC (Agentic Principal Chain), a permission-tracking system that narrows authority at every delegation step and checks each new request against everything the agent has already done, backed by mathematical proofs. Tested even under a fully compromised model, APC cut AgentDojo's data-exfiltration success rate from as high as 100% down to 0% and blocked all 544 data-theft attempts in InjecAgent.
What they did
- The paper argues the real risk of prompt injection (hidden malicious instructions smuggled into an AI's input) isn't just whether the model gets fooled, but whether the agent even has the authority to cause harm in the first place.
- APC tracks a chain of delegation from user to orchestrator to sub-agent to tool, shrinking permissions at every hop and keeping a running record of prior actions, then checks every new request against six conditions.
- A mechanism called 'composition closure' bans specific dangerous combinations of individually harmless actions in advance, such as reading a confidential document then sending an external email.
- The authors mathematically prove two properties: that an agent's potential damage ('blast radius') can only shrink, never grow, as authority is delegated further, and that forbidden action combinations can never occur if the ban list is complete.
- In a worst-case test simulating a fully compromised model, exfiltration attacks succeeded 0% of the time across all four AgentDojo domains and all 544 InjecAgent data-theft cases were blocked, destructive actions dropped from 38.6% to 4.0%, manipulative actions dropped from 90.5% to 12.1%, and the permission check itself took only 0.24 milliseconds.
Table 1. Adversary capabilities.| ID | Adversary capability |
|---|
| A1 | Inject content into the agent’s context via untrusted data sources (indirect prompt injection) |
| A2 | Fully compromise a single principal in the chain (sub-agent, tool server, or orchestrator) |
| A3 | Observe which actions succeed or fail to probe scope boundaries |
| A4 | Maintain influence for the duration of a task session |
Table 2. Trust boundaries (capabilities the adversary does not have).| ID | Trust boundary |
|---|
| T1 | Compromise the PDP, PEP, evidence sink, or key-management infrastructure |
| T2 | Forge cryptographic signatures or hashes |
| T3 | Operate across session boundaries |
Table 3. Security goals and the mechanisms that enforce them.| ID | Guarantee | Enforced by |
|---|
| G1 | No action outside scope S(pi) executes | Condition 2a |
| G2 | No prohibited action pair co-occurs in a session; k-tuple restrictions extend this to ordered subsequences | Condition 2b, Thm. 4.8, Prop. 4.9 |
| G3 | Blast radius does not increase at each delegation hop | Thm. 4.6 |
| G4 | High-impact actions require valid approval tokens | Condition 4 |
| G5 | Every admitted action is coupled to infrastructure-generated evidence, or execution is denied | Condition 5 |
| G6 | Actions outside declared intent are denied or flagged | Condition 6 |
Table 4. InjecAgent results (1,054 test cases). ASR = attack success rate (lower is better).| Condition | Data Stealing ASR | Direct Harm ASR | Total ASR |
|---|
| Baseline | 100.0% | 100.0% | 100.0% |
| Complete X | 0.0% | 60.4% | 29.2% |
| Partial X | 39.9% | 82.0% | 60.2% |
Table 5. ASB results (400 attack tools, 10 scenarios). ASR = attack success rate.| Condition | Stealthy ASR | Disruptive ASR | Total ASR |
|---|
| Baseline | 100.0% | 100.0% | 100.0% |
| Complete X | 30.0% | 0.0% | 15.0% |
| Partial X | 60.0% | 100.0% | 80.0% |
Table 6. Per-domain authoring burden.| Domain | Tools | Action Cls. | Pairwise | k-tuple | Resources |
|---|
| Workspace | 32 | 8 | 7 | 8 | 5 |
| Banking | 13 | 6 | 5 | 3 | 5 |
| Travel | 28 | 7 | 3 | 4 | 7 |
| Slack | 11 | 6 | 3 | 2 | 4 |
| InjecAgent | — | 9 | 8 | 0 | — |
| ASB | — | 7 | 9 | 0 | — |
Table 7. Utility preservation on four AgentDojo suites (Claude Sonnet 4.6). UPR = fraction of task–injection pairs where the user task is completed successfully. Values are means over 3 runs; ± denotes sample standard deviation. Δ columns report percentage-point differences computed from unrounded means.| Suite | Baseline | Strict | Inter. | Δ strict (pp) | Δ inter. (pp) |
|---|
| Workspace (560) | 96.2±0.2% | 81.5±0.1% | 86.7±0.4% | −14.7 | −9.6 |
| Banking (144) | 68.8±1.2% | 50.0±0.7% | 58.8±1.7% | −18.8 | −10.0 |
| Travel (140) | 59.8±1.1% | 55.7±0.7% | 60.0±1.4% | −4.0 | +0.2 |
| Slack (105) | 73.0±1.5% | 56.5±5.2% | 60.0±4.4% | −16.5 | −13.0 |
Table 8. Compromised-model evaluation on four AgentDojo suites (Claude Haiku 4.5). Ground-truth attack injection simulates a fully compromised model. Total: 609 unique task–injection pairs, 1,218 executions.| Suite / Category | Attack Tools | No Def. | APC | Blocking |
|---|
| Workspace (240 pairs) |
| Exfiltration | send_email | 90.0% | 0.0% | C2b + C4 + C6 |
| Destruction | delete_file/email | 48.8% | 5.0% | C6 (intent) |
| Manipulation | create_calendar | 97.5% | 30.0% | C6 (partial) |
| Banking (144 pairs) |
| Financial exfil. | send_money | 75.0% | 0.0% | C2b (formal) |
| Manipulation | update_sched_txn | 87.5% | 12.5% | C6 (partial) |
| Account takeover | update_password | 87.5% | 0.0% | C2b (formal) |
| Travel (120 pairs) |
| Exfiltration | send_email | 90.0% | 0.0% | C2b (formal) |
| Manipulation | reserve/calendar | 86.7% | 0.0% | C6 (no overlap) |
| Slack (105 pairs) |
| Ext. exfiltration | post_webpage | 100.0% | 0.0% | C2b (formal) |
| Int. exfiltration | send_direct_msg | 100.0% | 0.0% | k-tuple |
| Destruction | remove_user | 0.0% | 0.0% | — (attack fails undefended) |
| Reconnaissance | get_webpage | 100.0% | 0.0% | C6 (intent) |
Table 9. Taxonomy of residual attack successes (18 of 609 runs, 3.0% aggregated observed ASR).| Category | Attack Tool | Cases | Root Cause |
|---|
| Intent overlap | create_calendar_event | 12 | write class matches task intent |
| update_sched_transaction | 2 | write class matches task intent |
| Missing pair in X | delete_file | 4 | (read, delete) ∉X |
| Total | 18 | |
Table 10. Evaluation coverage across all benchmarks (3,154 evaluation instances). The compromised-model and utility cohorts are drawn from the same AgentDojo task–injection space and are therefore not disjoint.| Benchmark | Cases | Type | Main outcome |
|---|
| Delegation chains | 99 | Multi-hop (2–8 hops) | 99/99, all 6 conditions |
| InjecAgent | 1,054 | Public | Data stealing 0% |
| ASB | 400 | Public | Disruptive 0% |
| AgentDojo (utility) | 949 | Live LLM, 4 suites | Δ interactive −8.6 pp (mean, 3 runs) |
| AgentDojo (compromised) | 609† | Compromised-model | Exfil 0% all suites |
| Adaptive | 43 | Self-designed | 23/23 matched |
| †609 unique pairs, 1,218 total executions under two conditions. |
Table 11. Attack-class coverage summary. Residual values are observed ASR.| Attack class | Coverage | Main mechanism | Residual |
|---|
| Multi-step exfiltration | Full | C2b composition closure | 0% |
| Delegation priv. escalation | Full | Thm. 4.6 | 0% |
| Destruction (out-of-intent) | High | C6 intent binding | 4% |
| Manipulation (in-intent) | Partial | C6 (action-type granularity) | 12.1% |
| Single-action within scope | None | Outside APC boundary | 60.4% |
| Parameter-level misuse | None | Requires param. validation | — |
Table 12. Formal results: assumptions, guarantees, and supporting evidence.| Property | Assumption | Guarantee | Evidence |
|---|
| Blast-radius mono. (Thm. 4.6) | Scope narrowing; cumulative budget tracking; consistent blast(r) | Reachable blast radius non-increasing per hop | 99 chain scenarios (depths 2–8) |
| Comp. soundness (Thm. 4.8, Prop. 4.9) | Complete Xeff, K; serialized admission | No admissible sequence produces prohibited outcome | InjecAgent 0% DS; ASB 0% disruptive; adaptive all matched |
Table 13. Adaptive attack results (representative subset). Twenty-three named attacks with 43 variants target all six conditions.| Attack | Strategy | Result |
|---|
| Decomposed Exfil | read → write → send_internal (evades pairwise) | blocked (k-tuple) |
| Intent Drift | in-scope, out-of-intent resource | blocked (C6) |
| Budget Exhaustion | 3 transfers, budget max 2 | blocked (C2c) |
| Approval Replay | reuse token with different parameters | blocked (C4 hash) |
| Expired Token | use approval token after TTL expires | blocked (C4 temporal) |
| Consumed Token | reuse single-use token after consumption | blocked (C4 single-use) |
| Evidence Evasion | act when evidence sink is down | blocked (C5 fail-closed) |
| Scope Probing (A3) | probe resources, actions, classifications | boundaries enforced |
| Gradual Buildup (A4) | 8-step sequence with interleaved noise | blocked (pair + k-tuple) |
| Session Splitting | split read/send across sessions | admitted (per-session) |
| Cross-Session Token (T3) | replay session-A token in session-B | blocked (C4 session) |
| Envelope Forgery (T2) | sign envelope with wrong key | blocked (signature) |
| Envelope Tampering (T2) | modify sealed envelope scope | blocked (immutability) |
| Depth Overflow | act beyond delegation depth ceiling | blocked (C2c) |
| Intent Warn Mode | out-of-intent in warn vs strict mode | graduated enforcement |
Table 14. Enforcement mechanism comparison on InjecAgent (1,054 cases) and ASB (400 cases). | InjecAgent | ASB | |
|---|
| Mechanism | DS | DH | Total | Stlth. | Disr. | Class |
| Comp. closure (APC) | 0.0% | 60.4% | 29.2% | 30.0% | 0.0% | Action-class pairs |
| Info flow (SEAgent sim.) | 1.7% | 59.2% | 29.5% | 60.0% | 60.0% | Sensitivity labels |
Table 15. Enforcement latency on the environment above. Median of five repetitions; bracketed values are the range across repetitions. Reproduced from the committed measurement artifact evals/latency/results/latency_appendix_d.json.| Component | p50 (ms) | p99 (ms) |
|---|
| Full admissibility, C4 below threshold | 0.049 [0.048–0.050] | 0.240 [0.173–0.261] |
| Full admissibility, C4 token verified | 0.057 [0.056–0.058] | 0.236 [0.215–0.345] |
| Composition closure (isolated) | 0.0016 [0.0012–0.0021] | 0.0031 [0.0016–0.0033] |
| Envelope narrowing (meet + re-sign) | 0.015 [0.015–0.016] | 0.059 [0.049–0.081] |
Table 16. Standalone coverage of APC properties by existing authorization mechanisms.| Property | OAuth+OPA | Prompts | Static Manifest | APC |
|---|
| Scope enforcement (G1) | ✓ | — | — | ✓ |
| Scope attenuation | Partial | — | Tool-level | ✓ |
| Composition closure (G2) | — | — | — | ✓ |
| Blast-radius mono. (G3) | — | — | — | ✓ |
| Approval binding (G4) | — | — | — | ✓ |
| Evidence commit. (G5) | Partial | — | — | ✓ |
| Intent binding (G6) | — | — | — | ✓ |
Table 17. APC versus modern agentic security systems.| Property | SEAgent | CaMeL | Progent | APC |
|---|
| Data stealing ASR | 0%a | — | — | 0% |
| Composition closure | Policy-dep. | Dataflow-dep. | Policy-dep. | Formalb |
| Blast-radius mono. | — | — | Temporalc | Structural |
| Multi-hop delegation | Partial | — | Partialc | ✓ |
| Intent binding | — | — | — | ✓ |
Table 18. Illustrative blast scores under default weights.| Resource | scope | irrev | sens | blast | Rationale |
|---|
| User calendar entry | 0.1 | 0.2 | 0.1 | 0.14 | Single user, recoverable, low sensitivity |
| Shared team document | 0.4 | 0.3 | 0.6 | 0.40 | Team scope, versioned, confidential |
| Customer PII record | 0.6 | 0.7 | 1.0 | 0.72 | Broad scope, hard to remediate, restricted |
| Production database | 0.9 | 0.9 | 0.8 | 0.88 | Org-wide, near-irreversible, restricted |
| External email send | 0.7 | 1.0 | 0.5 | 0.78 | Unrecallable, broad reach, variable sensitivity |
Why it matters
Most AI agent security work focuses on making the model itself resist bad instructions, but this research shows that redesigning the underlying permission architecture can block attacks regardless of how well the model behaves. As companies increasingly chain multiple AI agents together for real work, having a publicly available implementation and evaluation toolkit makes this immediately relevant for practical deployment.
Terms in this paper
- prompt injection · an attack that hides malicious instructions inside documents or data fed to an AI so it takes unintended actions
- APC (Agentic Principal Chain) · the permission-tracking system proposed in this paper that follows delegated authority from user to sub-agents to tools and checks every request
- composition closure · a rule system that bans specific combinations of otherwise individually-allowed actions
- PEP/PDP · Policy Enforcement Point and Policy Decision Point, a separate gatekeeper outside the AI model that actually allows or blocks each action
- attack success rate (ASR) · the percentage of attack attempts that actually succeeded; lower means better defense
Original abstract (English)
LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.
Authors · Xabier Muruaga
Read on arXiv
