The Confused Deputy Problem in AI Agents
An AI agent needs both a way to interact with external systems and permission to access them. A scheduling agent needs calendar access. A coding agent may need a repository token. An assistant used in a government workflow might need internal documents, case-management systems, or procurement records.
Each permission helps the agent complete its work, but it also creates an opportunity for misuse. One of the risks is known as the confused deputy problem.
A deputy is a system that holds authority another party does not have. The problem occurs when someone causes that system to exercise its authority on their behalf without being authorized to do so. The API and credentials may work exactly as intended. The failure lies in allowing valid permissions to serve the wrong request.
How an AI Agent Becomes the Deputy
Consider an agent that can read internal files and send emails for an employee. The employee asks it to summarize a document received from an external vendor. Hidden text in that document tells the agent to find confidential files and email them to an outside address.
If the model follows those instructions, it may use its legitimate credentials to carry out the attack. The document never needed direct access to the file system or email account. It only needed to influence an agent that already had those privileges.
This is an indirect prompt-injection attack, with the agent serving as a confused deputy. The untrusted document supplies the intent. The agent supplies the authority.
Authority can also become confused without an attacker. An ambiguous request might lead an agent to modify the wrong account, retrieve records beyond the user’s scope, or exceed an approval limit. Not every misunderstanding qualifies as a confused deputy failure, but the underlying lesson still applies: valid credentials do not prove that a particular action is appropriate.
Why Authentication Is Not Enough
Authentication establishes the identity of a user, agent, or service. Authorization defines what that identity may do. Agentic systems introduce a third question: whose authority is the agent using for this particular task?
A shared service account makes that question difficult to answer. An external system may recognize which agent made a request without knowing which user initiated it, why the action was requested, or which limits should apply.
NIST’s February 2026 draft concept paper on software and AI-agent identity raises these same concerns. It asks how organizations should handle least privilege, delegated authority, changing context, and the connection between agent identities and human users.
Prompt Defenses Cannot Enforce Authorization
Developers often tell models to separate trusted commands from untrusted content. That guidance can reduce risk, but it cannot serve as the only security boundary. A model still has to interpret which instructions deserve trust, and carefully designed adversarial content may exploit mistakes in that judgment.
The runtime should enforce authorization through deterministic software before any tool call is executed. It should verify who initiated the request, which agent is acting, what resource is involved, and what action has been proposed. Those checks should rely on trusted application state and include any limits attached to the current task.
A user’s general ability to read files and send email does not automatically authorize an agent to send a particular file to a particular recipient. The model can propose the operation. A separate policy layer must decide whether it is allowed.
OWASP describes excessive agency as the risk created when language-model systems receive more functionality, permissions, or autonomy than they need. Limiting those capabilities reduces what an attacker can accomplish by manipulating the model.
Architectural Controls for the Deputy
No single safeguard resolves this problem. Production systems need several controls working together:
Use task-scoped credentials: Issue short-lived tokens that allow only the resources and actions required for the current task.
Preserve user identity: Carry the initiating user’s identity and authorization context through every tool call.
Separate read and write authority: An agent that summarizes documents may need to read them without gaining permission to email, delete, or modify them.
Validate the action: Check the target resource, recipient, data classification, and requested operation before execution.
Require approval for consequential actions: Show a reviewer the exact action, target, and relevant data before committing it.
Record the delegation chain: Log who initiated the task, which agent acted, what tool it called, which credential it used, and how the policy engine responded.
The runtime should also preserve the origin of information as it moves through the workflow. Text from an external webpage or uploaded file may be useful evidence, but it should not quietly become a trusted instruction. Provenance labels and data-flow tracking give policy engines more context when deciding whether to allow a sensitive action. Those labels cannot prove which passage influenced the model, but they can help prevent untrusted content from gaining authority it was never meant to have.
Production Takeaways
The confused deputy problem explains why securing an agent requires more than controlling its behavior. An authenticated agent can still misuse legitimate permissions when it follows the wrong party’s request.
Production systems should give agents the minimum permissions required, preserve the identity behind each request, and enforce authorization outside the model. Actions with serious or difficult-to-reverse consequences should require explicit approval.
Broad permissions granted for possible future tasks create unnecessary exposure. Every action should have a clear connection to an accountable identity, an authorized purpose, a defined set of resources, and a policy decision. With those controls in place, organizations can use agentic automation without allowing anyone who influences the model to borrow the agent’s authority.