Bounded Agents: Delegation Security for Multi-Agent AI Systems

Summary

LLM-based agents act on behalf of users to access cloud services, call tools, or invoke agents, but permissions remain static and each request is evaluated independently, allowing deviations from delegated tasks, prohibited combinations of actions, or unrestricted sub-delegation. The Agentic Principal Chain (APC) tracks delegated authority and evaluates requests against accumulated session state using six checks, carrying forward restricted scope and budgets, and enforcing decisions outside the model via composition closure. In evaluations across 3,154 instances (InjecAgent, AgentDojo, ASB), APC reduced AgentDojo exfiltration from 75-100% to 0% across all domains, blocked all 544 InjecAgent data-stealing cases, and reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile, but utility dropped 8.6 and 13.9 percentage points in AgentDojo task-injection pairs. Implementation, evaluation tools, and data are public.