Bounded Agents: Delegation Security for Multi-Agent AI Systems
Xabier Muruaga
cs.AI, cs.CR
2026-08-17
APC enforces session-scoped authorization outside the model. AgentDojo exfiltration hits 0% in four domains; all 544 InjecAgent theft cases blocked; utility drops 8.6–13.9 pp.
Once an LLM agent can call tools, spawn sub-agents, and touch cloud APIs, classical access control is the wrong shape. Permissions freeze at session start. Each request is judged alone. Inside those permissions the agent can still ignore the delegated task, hand a full grant to a sub-agent, or compose two allowed calls (read a confidential file, then send external email) into exfiltration.
Prompt injection is only dangerous if the agent is authorized to do the damaging thing. APC treats that as an authorization-architecture problem. The model in the loop is untrusted by construction. Alignment does not close a composition hole.
APC tracks a chain of principals: human, orchestrator, sub-agent, tool. Infrastructure issues a signed authorization envelope at session start and narrows it at every hop; a downstream principal cannot widen it. Scope is a four-tuple of resources, action types, data classifications, and prohibited compositions. A separate budget caps delegation depth, blast radius, irreversible effects, sensitivity, cross-domain mixing, and compute.
Every proposed action must pass six conjunctive checks before the tool gateway (the PEP) lets it run:
Composition closure is the distinctive primitive. Pairwise bans stop "read then sendexternal". Ordered k-tuples catch staged paths that no pair forbids, such as read, write-intermediate, then exfiltrate. The model never sees the envelope and cannot rewrite it.
Evaluation covers 3,154 instances across InjecAgent, ASB, and AgentDojo. The compromised-model setting inserts the benchmark's ground-truth attack tool call after the first legitimate call, so the test measures the gateway, not model stubbornness.
| Setting | No defense | APC |
| AgentDojo exfiltration (4 domains) | 75–100% | 0% |
| InjecAgent data stealing (544) | 100% | 0% |
| InjecAgent direct harm | 100% | 60.4% |
| ASB disruptive | 100% | 0% |
| Destruction ASR | 38.6% | 4.0% |
| Manipulation ASR | 90.5% | 12.1% |
Utility is measured on 949 task-injection pairs with Claude Sonnet 4.6. Strict mode costs 13.9 percentage points; interactive approval costs 8.6. Authorization-path latency on an idle host is 0.24 ms at p99. Drop one pair from X and data-stealing ASR rises from 0% to 39.9%. Of 18 residual successes out of 609, 14 are intent overlap at action-type granularity and 4 miss the (read, delete) pair. In the adaptive suite, 23 of 24 prohibited-outcome variants are blocked; the admitted one is session splitting, documented as a cross-session blind spot.
What a deployment can actually buy: even if the model is injected, or treated as fully compromised, combination-only attacks such as exfiltration can be stopped by policy. Latency is negligible. The bill is a few points of task success plus 3–9 pairwise restrictions and a handful of k-tuples per security domain. APC does not replace OAuth or RBAC. It is a session layer on top.
For teams that already gate tools at an MCP gateway, this is an architecture they can put in the path, not another alignment fine-tune.
Composition soundness needs a complete restriction set X and serialized admission; concurrent sub-agents must serialize the composition check. Direct-harm ASR stays at 60.4% because single-action misuse inside scope needs parameter-level validation, which APC refuses to own. Action-type taxonomy is expert work; too coarse and a legitimate write collides with an attack class. All benchmarks are synthetic. The compromised-model insert after step one does not cover multi-turn interleaving or an adversary that adapts to denials. Theorems are not machine-checked. Cross-session attacks are out of scope.