Prevent confused-deputy attacks by making every agent and downstream service authorize the specific operation and resource against the originating principal’s delegated authority—not against the identity or credentials of whichever agent happens to make the call. Enforce that decision at a broker, gateway, runtime, or service boundary outside the model. A prompt, trusted agent identity, or instruction to a sub-agent is not an authorization control.
What makes agent delegation a confused-deputy risk?
A confused deputy is a more-privileged component that is tricked into using its authority for a less-privileged requester. AWS describes the core issue as an entity without permission coercing a more-privileged entity to perform an action. In an agent system, the deputy might be an orchestrator, a tool-using agent, or a service that holds credentials broader than the user’s grant.
As an Amazon Associate I earn from qualifying purchases.
For example, a user asks an orchestrator to summarize a document. The orchestrator can read a shared drive, while the user cannot access a particular customer folder. A malicious instruction embedded in a retrieved document tells the orchestrator to send that folder to another agent. If the downstream agent sees only the orchestrator’s trusted identity or bearer credential, it may perform the read or transfer without knowing whether the original user authorized that target.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The crucial distinction is between who made the API call and whose authority permits the requested action. The privileged agent’s identity establishes the caller, not the authorization for every action it asks to perform. Prompt injection makes this distinction especially important: external content may influence the model’s proposed action, but it must not expand the action’s authority.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use a separate authorization decision at every hop
Model delegation as a chain of constrained grants. At each boundary, preserve enough verifiable context to establish the originating principal and delegation chain, then authorize the exact downstream action and resource. A useful design rule is that a child agent’s effective authority cannot exceed either the parent’s grant or the grant for the child’s task: it is the intersection of the two, not the union.
- Identify the principal and delegation context. Record who initiated the task, which agent is acting now, and which authorized delegations led to this call. Do not substitute the current agent’s service identity for the originating principal.
- Bind the request to its intended audience. Ensure the credential or authorization is intended for the downstream service that will consume it. Validate issuer, audience, expiry, and scope according to the system’s security model.
- Check the concrete operation and target. Authorize an action such as reading a named object or sending a message to a specified recipient—not merely the broad capability to use a tool or call an agent.
- Issue or pass only the narrow grant needed. Limit the child’s permitted operations and resources. A child must not be able to add scopes, substitute a target, or impersonate another principal.
- Enforce the decision outside model reasoning. Route the call through a policy-enforcing boundary that rejects unauthorized requests even if the model or an upstream agent is fully compromised.
This is a design synthesis, not a single standard-mandated recipe. OAuth Token Exchange, defined by RFC 8693, can support exchanging a token for a downstream audience; the protocol does not by itself define the complete task-level authorization policy for agent delegation.
Rank #2
- Programmer Gift - Cybersecurity The Few The Proud, The Paranoid. Get this to have the best information security workers present. Computer programmer, computer coder, and anyone in IT tech!
- Material: Stainless Steel, it is lead free and nickel free, hypo allergenic, it doesn’t rust, change colour or tarnish.
- Measurement: 30mm(1.18"). TIPS:manual measuring permissible error.
- If you are a cybersecurity engineer and you love to work with computer science this will be a great gift for you to wear. People who like programming, hackers and hacking will like this fantastic IT security keychain.
- Velvet bag- Only the most elegant velvet jewelry pouches are used to package and ship our bangle. If you have any quality problems, please feel free to contact us and we will give you a proper solution until you satisfied.
Choose enforcement mechanisms that fit the boundary
| Mechanism | What it can contribute | What it does not solve by itself |
|---|---|---|
| OAuth token exchange (RFC 8693) | A standardized way to obtain a token for a downstream audience, supporting identity continuity and audience-specific credentials. | It does not specify the full policy for which agent may perform which operation on which task resource. |
| Cloud IAM conditions | Platform-specific controls can constrain role assumption or resource access. For AWS cases, external IDs and supported source-context condition keys address particular cross-account and cross-service risks. | These controls are not a universal agent-delegation solution; available conditions vary by service and use case. |
| Authorization broker or gateway | A custom enforcement point can evaluate task-level policy, delegation context, operation, and target before forwarding a call. | It creates implementation and operational responsibilities, including policy correctness, availability, and protection against bypass through ambient credentials. |
Compare candidate designs on identity continuity, authority attenuation, audience and target binding, enforcement independence, expiry and revocation, auditability, and fit with the services in use. The cited material does not establish a neutral benchmark across deployed products or a universal winner.
Apply AWS protections to the AWS cases they cover
Third-party services assuming cross-account roles
When a third-party service assumes a role in a customer’s AWS account, use a unique external ID per customer, controlled by the service, and verify it in the role trust policy. This helps prevent a third party from being induced to assume a customer’s role in the context of a different customer’s request. The external ID is a confused-deputy protection for this role-assumption pattern; it is not a general proof that every later action is authorized for a user or task.
AWS services accessing customer resources
When a trusted AWS service principal accesses a resource, use supported source-context conditions in the resource policy where appropriate. AWS recommends considering aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, or aws:SourceOrgPaths where supported. Check the current service-specific guidance before deployment: support and the right condition depend on the AWS service and access pattern.
Keep untrusted content from becoming authority
Retrieved pages, documents, emails, and tool responses are data, not authorization. A model may use their contents to propose a next step, but the enforcement point must independently compare that proposed step with the caller’s grant. Do not let text from a document, a tool result, or an upstream agent add a recipient, resource, scope, or operation that the authorized task did not permit.
Rank #4
- KEYCHAIN WITH CHARM: Our circle keychains have just the right balance of fun and function, and hold your key collection together with style. Made from aluminum.
- PROFESSIONALLY PRINTED: Thousands of vivid prints to choose from
- IDENTIFY YOUR KEYS: Easily find your lost keys with our unique novelty prints
- GIFTABLE: A perfect addition to any gift set
- IDEAL FOR YOURSELF & A UNIQUE GIFT: Surprise your husband, brother, dad, grandpa, son, uncle or friend, or order one just for you! Our men's pajamas make a unique and thoughtful gift for Christmas, Father's Day, Mother's Day and birthdays, or just because!
- Require independent human confirmation for irreversible, high-impact actions.
- Make sure confirmation covers the concrete action and target, rather than serving as a generic approval for the entire agent task.
- Do not expose ambient credentials that let a compromised agent bypass the broker or gateway.
Build an audit trail and test the boundaries
For each attempted operation, retain enough information to reconstruct the authorization decision and the call that followed it. Log the originating principal, delegation chain, requested operation, target, policy decision, downstream call, and any relevant human approval. Monitor for actions outside the expected task or resource boundary.
Free tools Windows power users keep installed
One-click scans. No signup required.
Include adversarial cases in security testing. These are test scenarios motivated by the threat model, not claims that every system has already been tested against them:
- A replayed, expired, revoked, or mismatched delegation context.
- A child agent requesting a sibling’s resource or a broader operation than its parent grant allows.
- A substituted target, recipient, or downstream audience.
- Malicious instructions in retrieved content or tool output that request a privileged action.
- An attempt to call a downstream service directly with ambient credentials instead of passing through the enforcement point.
What recent agent-security evaluation shows—and does not show
Dantuluri and Sundi’s 2026 paper evaluates an authorization-broker design against modeled agent threats. In the paper’s evaluation, the broker accepted 0 forged tokens out of 200,000 attempts. Across 2,000 randomized scenarios, the paper reports a mean of 1.5 reachable actions for a compromised sub-agent under its evaluated broker, versus all 8,100 under bearer delegation. The authors also report about 2.6 microseconds per authorization decision in that evaluation.
These are results reported by the paper’s authors for their evaluation, not general performance guarantees, a neutral comparison of commercial products, or independently replicated results. The same paper reports that its tested default runtime—using broad bearer credentials and model-internal authorization—failed its four modeled threats. That finding describes the runtime and threats the authors evaluated, not every agent framework or deployment. Their formulation, “Security that depends on the model not being hijacked is not security,” is the authors’ position rather than a consensus standard.
Quick Recap
Implementation checklist
- Inventory every principal, agent, credential, tool, and downstream service. Mark shared credentials, agent-to-agent instruction paths, and services that trust an agent without receiving the originating caller’s authority.
- Define grants as explicit allowed operations and target resources. Scope downstream credentials as narrowly as the API permits; use distinct agent credentials rather than human credentials where appropriate.
- At each hop, authenticate the caller, preserve the originating principal and delegation chain, check the downstream audience, and reject operations or targets outside the grant. Token exchange may support this flow, but does not replace its authorization policy.
- Put authorization in an independent enforcement point and prevent compromised agents from bypassing it with ambient credentials.
- For the applicable AWS role-assumption and service-to-resource cases, configure external IDs or supported source-context conditions as appropriate, then verify support in current service-specific guidance.
- Treat external content and tool output as untrusted; independently gate high-impact actions and keep attributable logs of tool and API calls.
- Test delegation replay or mismatch, target substitution, sibling-resource access, excess scope, malicious tool output, expired or revoked authority, and prompt-injected instructions.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
