Bounded Agents: Delegation Security for Multi-Agent AI Systems

The Core Problem: Static Permissions Aren't Enough

LLM-based agents operating on behalf of users face a fundamental security gap. When an agent starts a session, it receives a fixed set of permissions—say, "read emails" and "send messages." The system then evaluates each request independently, never asking whether a sequence of individually allowed actions combines into something dangerous. An agent could exfiltrate data by reading emails, then send them via an allowed messaging tool. Or a prompt injection attack only becomes dangerous if the agent has permission to execute the injected commands. The threat isn't purely about tricking the model; it's an authorization architecture problem.

How Agentic Principal Chain Works

The authors propose the Agentic Principal Chain (APC), a runtime enforcement system that treats delegation like a chain of custody. Instead of one-shot permission checking, APC tracks accumulated session state and restricts what agents can do based on their history.

APC uses six authorization checks to evaluate each request:

• Did this action already occur (preventing duplicates)?
• Does it exceed remaining budget (tracking resource limits)?
• Does it violate scope restrictions (narrowing what sub-agents can do)?
• Does it combine with prior actions into a prohibited outcome (composition checking)?
• Is the delegation being passed to a sub-agent properly bounded?
• Is the decision enforced outside the model (not just suggested)?

The key insight is composition closure: checking not just individual actions but forbidden combinations. If reading emails + sending externally is prohibited, APC prevents the second action if the first already happened. When an agent delegates authority to a sub-agent, APC carries forward restrictions and budgets, ensuring the sub-agent can't do more than intended.

The authors prove two properties: Blast Radius Monotonicity (restricting scope cannot increase damage) and Composition Soundness (the system correctly prevents prohibited combinations under complete restriction sets and serialized processing).

Empirical Results and Tradeoffs

The evaluation tested 3,154 real attack instances from three benchmarks: InjecAgent, AgentDojo, and ASB. To isolate APC's effectiveness from model behavior, the authors ran a "compromised model" test: they injected the actual attack command after the first legitimate tool call, forcing the agent to execute it if permissions allowed.

Results were dramatic:

• AgentDojo exfiltration dropped from 75–100% to 0% across all domains.
• All 544 InjecAgent data-stealing attacks were blocked.
• Intent binding (restricting agent intent drift) reduced destruction attacks from 38.6% to 4.0% and manipulation from 90.5% to 12.1%.

Authorization overhead was minimal: 0.24 ms at the 99th percentile. However, there was a utility cost—legitimate task completion dropped by 8.6 to 13.9 percentage points in AgentDojo settings, suggesting APC errs on the side of caution.

The system is production-ready: implementation, evaluation tools, and datasets are open-source. The tradeoff is clear: strong security against agent misbehavior and injection attacks comes at the cost of occasionally blocking valid user requests.