CoChat
Sign Up
PreprintCited by 1Access Control and TrustAdversarial Robustness in Machine LearningSecurity and Verification in Computing

Bounded Agents: Delegation Security for Multi-Agent AI Systems

Open access
Muruaga, Xabier·2026·arXiv
DOI 10.48550/arxiv.2608.15888arXiv 2608.15888
Open this paper in CoChat — free accountOpen PDF

Abstract

LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2608.15888

Cites

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

No references could be resolved yet.

Research works printed but not linked: 22

  1. [2][2] Mislav Balunovic et al. 2024. AI Agents with Formal Security Guarantees. In ICML Next Generation of AI Safety Workshop . -
  2. [4][4] Edoardo Debenedetti et al. 2024. AgentDojo: A Dynamic Environment to Evaluate Attacks and Defenses for LLM Agents. arXiv preprint arXiv:2406.13352 (2024). - · arXiv
  3. [5][5] Edoardo Debenedetti et al. 2025. Defeating Prompt Injections by Design. arXiv preprint arXiv:2503.18813 (2025). - · arXiv
  4. [6][6] Dorothy E. Denning. 1976. A Lattice Model of Secure Information Flow. Commun. ACM 19, 5 (1976), 236-243. -
  5. [7][7] Jack B. Dennis and Earl C. Van Horn. 1966. Programming Semantics for Multiprogrammed Computations. Commun. ACM 9, 3 (1966), 143-155. -
  6. [8][8] M. Dziemian et al. 2026. How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition. arXiv preprint arXiv:2603.15714 (2026). - · arXiv
  7. [11][11] Zimo Ji, Daoyuan Wu, Wenyuan Jiang, Pingchuan Ma, Zongjie Li, Yudong Gao, Shuai Wang, and Yingjiu Li. 2026. Taming Various Privilege Escalation in LLMBased Agent Systems: A Mandatory Access Control Framework. arXiv preprint arXiv:2601.11893 (2026). - · arXiv
  8. [13][13] Shaun Khoo et al. 2025. With Great Capabilities Come Great Responsibilities: Introducing the Agentic Risk & Capability (ARC) Framework for Governing Agentic AI Systems. arXiv preprint arXiv:2512.22211 (2025). - · arXiv
  9. [14][14] Karolina Korgul et al. 2025. It's a TRAP! Task-Redirecting Agent Persuasion Benchmark for Web Agents. arXiv preprint arXiv:2512.23128 (2025). - · arXiv
  10. [17][17] Mark S. Miller. 2006. Robust Composition: Towards a Unified Approach to Access Control and Concurrency Control . Ph. D. Dissertation. Johns Hopkins University. -
  11. [18][18] Andrew C. Myers and Barbara Liskov. 1997. A Decentralized Model for Information Flow Control. In ACM Symposium on Operating Systems Principles (SOSP) . -
  12. [19][19] Andrew C. Myers and Barbara Liskov. 2000. Protecting Privacy Using the Decentralized Label Model. ACMTransactions on Software Engineering and Methodology 9, 4 (2000), 410-442. -
  13. [23][23] Ruoming Pang et al. 2019. Zanzibar: Google's Consistent, Global Authorization System. In USENIX Annual Technical Conference (ATC) . -
  14. [24][24] M. Rajagopalan and V. Rao. 2026. Authenticated Workflows: A Systems Approach to Protecting Agentic AI. arXiv preprint arXiv:2602.10465 (2026). - · arXiv
  15. [26][26] Yangjun Ruan et al. 2024. Identifying the Risks of LM Agents with an LMEmulated Sandbox. arXiv preprint arXiv:2309.15817 (2024). - · arXiv
  16. [27][27] Ravi S. Sandhu, Edward J. Coyne, Hal L. Feinstein, and Charles E. Youman. 1996. Role-Based Access Control Models. IEEE Computer 29, 2 (1996), 38-47. -
  17. [28][28] Tianneng Shi et al. 2025. Progent: Securing AI Agents with Privilege Control. arXiv preprint arXiv:2504.11703 (2025). arXiv v3, revised May 2026; our evaluation used the earlier artifact. - · arXiv
  18. [29][29] Tobin South et al. 2025. Authenticated Delegation and Authorized AI Agents. arXiv preprint arXiv:2501.09674 (2025). - · arXiv
  19. [30][30] Tobin South et al. 2025. Identity Management for Agentic AI. arXiv preprint arXiv:2510.25819 (2025). - · arXiv
  20. [31][31] Qiusi Zhan et al. 2024. InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. In Findings of the Association for Computational Linguistics (ACL) . -
  21. [32][32] Hanrong Zhang et al. 2024. Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-Based Agents. arXiv preprint arXiv:2410.02644 (2024). - · arXiv
  22. [33][33] Yuxuan Zhu, Antony Kellermann, Akul Gupta, Philip Li, Richard Fang, Rohan Bindu, and Daniel Kang. 2026. Teams of LLM Agents Can Exploit Zero-Day Vulnerabilities. In Proceedings of the Conference of the European Chapter of the Association for Computational Linguistics (EACL) . arXiv:2406.01637. · arXiv

Cited by

Sorted by citations

Authors
Muruaga, X.
Corresponding author
Muruaga, Xabier
Venue
arXiv
Publisher
arXiv
Published
2026
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2608.15888
arXiv
2608.15888
OpenAlex
W7203698602
Cited by
0
References
0
Type
posted content
Language
en
Open access
Licence
Locations
  • arXiv (Cornell University) (submittedVersion, cc-by)
  • Zenodo (CERN European Organization for Nuclear Research) (submittedVersion, other-oa)
  • arXiv (Cornell University) (cc-by)
  • Zenodo (CERN European Organization for Nuclear Research)
Topics
  • Social Sciences › Sociology and Political Science › Access Control and Trust
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
Keywords
LLM agents, prompt injection, authorization architecture, multi-agent systems, data exfiltration

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review