Bounded Agents: Securing Delegation in Multi-Agent AI

Introduction

As language-model agents begin acting for users, accessing cloud services, calling tools, and delegating work to other agents, authorization becomes a systems problem. A model may have permission to perform several harmless actions separately, yet combine them into data exfiltration, resource destruction, or business manipulation. The paper Bounded Agents: Delegation Security for Multi-Agent AI Systems argues that prompt injection is only the trigger; the decisive question is whether the surrounding authorization architecture permits the resulting action.

Key ideas

• Session-aware authorization. Many agent systems establish permissions at session start and evaluate each request independently. The Agentic Principal Chain (APC) instead carries forward execution history, current scope, and the chain of principals involved in delegation.
• Constrained delegation. A sub-agent does not automatically receive the delegating agent’s full authority. APC propagates a narrowed scope and restricted budgets, preventing authority from expanding as work moves through multiple agents.
• Protection against action composition. A request that looks safe in isolation may become unsafe in combination with earlier actions. APC uses composition closure to check the new request against prior activity, rather than examining only the immediate tool call.
• Enforcement outside the model. The model may suggest an action, but a separate authorization layer makes the admission decision. This reduces dependence on the model’s ability to recognize malicious instructions or preserve the original task intent.
• Formal guarantees with conditions. The paper proves Blast Radius Monotonicity and Composition Soundness for APC implementations. The latter is specifically limited to prohibited combinations covered by a complete restriction set and processed through serialized admission.

Evaluation

The study evaluates 3,154 instances from InjecAgent, AgentDojo, and the Agent Security Bench. In AgentDojo’s four domains, reported exfiltration rates fell from 75–100% to 0%, destruction from 38.6% to 4.0%, and manipulation from 90.5% to 12.1%. APC blocked all 544 data-stealing cases in InjecAgent and all disruptive cases in the cited Agent Security Bench evaluation. It also validated 99 of 99 delegation chains ranging from two to eight hops. Authorization latency was reported as 0.24 milliseconds at the 99th percentile.

Why it matters—and where it stops

APC offers a practical separation of responsibilities: the model proposes plans, while an external control plane decides whether each action remains within the delegated mandate. This is useful for tool-use platforms, cloud automation, and systems in which agents can call one another. Retained authorization state can also improve auditing by showing how a particular capability was inherited and narrowed.

The guarantees are not automatic protection against every deployment failure. Composition Soundness depends on the restriction set covering the relevant dangerous combinations and on serialized admission. An omitted policy rule can therefore leave a gap even when the enforcement mechanism works correctly. The broader engineering lesson is to treat delegation scope, budgets, action history, and prohibited combinations as first-class security policy—not as behavior the model is expected to infer on its own.

Source: Hugging Face Daily Papers