Agent identity and delegated authority

Read these first

• Human in the loop
• MCP auth

What you will know

• Give an agent scoped credentials rather than a user's session

  The credential should be limited by tool, operation, resource, and lifetime, so a prompt or tool compromise cannot inherit the user's entire access.

• Reproduce a confused-deputy failure using a low-privilege user and an over-privileged tool

  A seemingly valid request can make a trusted backend perform an operation the user could never perform directly.

• Authorise per action rather than per session

  A successful login does not prove that a later tool call still falls within the user's current scope or intent.

• Audit what an agent did on whose behalf

  Record the user, agent, tool, resource, policy decision, and correlation identifiers so incidents can distinguish user intent from model behavior.

• Patch an agent integration that receives a human's session token so it uses a short-lived, audience-bound delegated credential instead

  Bearer session tokens invite replay and lateral access, while expiry and audience binding constrain the damage from leakage.

Chapters

1. 1

   A delegated credential is bounded by tool, resource and clock

   Acting on behalf of someone does not mean acting as them. The credential an agent carries names the operations it may perform, the resources it may touch, the service it may present to, and the minutes before it expires, so a compromised prompt or tool inherits a slice rather than an identity. This chapter builds that credential and works out where each bound comes from.

   Read chapter
2. 2

   Forwarding the session cookie gives the agent everything at once

   The integration works, which is the problem: the browser's cookie now sits in prompts, logs and tool arguments, valid against every internal API for as long as the user stays signed in. The minimal fix is a server-side exchange for a token minted per task, expiring in minutes and bound to one audience, so a leaked copy cannot be replayed against a second service. Make the argument in those terms, not by naming a protocol.

   Read chapter
3. 3

   The human principal has to travel as a verifiable claim

   A bounded credential says what may be done; it does not say on whose behalf. For a service to check an entitlement it never granted, the token reaching it must carry two principals — the human subject and the agent acting for them — in a form that service can verify, rather than a user id in a request body the agent could have written itself. Build that delegation claim into the exchange from the previous chapter, work out what each hop can actually check and what it must take on trust, and notice that this single field is what the confused-deputy fix and the audit record both spend later.

   Read chapter
4. 4

   A backend that acts because the agent asked is a confused deputy

   Reproduce it: a user with read-only access phrases a request, the agent calls an internal service whose own credentials are broad, and the service performs a write the user could never have performed. Reducing the agent's permissions sometimes helps and sometimes hides it, because the real defect is a backend that never checks who the originator was. This chapter puts the check where the authority is spent, using the delegation claim the previous chapter put on the wire.

   Read chapter
5. 5

   Signing in does not authorise the tool call three steps later

   A session says who arrived; it says nothing about whether this particular deletion, on this particular record, is inside what that person may do right now. Move the decision to the action: evaluate policy at each tool call with the user, the operation, the resource and the current context in hand. The cost is a policy call per step, and this chapter covers where to cache it without recreating the session.

   Read chapter
6. 6

   An offline agent needs consent bound to actions, not a refresh token

   A nightly job that declines calendar invitations has no human to approve anything, so the approval has to have happened in advance and attached to specific operations. Storing a refresh token instead grants the sleeping user's full reach every night. Here you design that grant: which operations it covers, which it must refuse outright, how it expires, and what the run does when it meets a case outside the grant.

   Read chapter
7. 7

   An agent's audit trail must separate user intent from model choice

   An ordinary log line saying a user deleted a record cannot answer the question agents create: did the person ask for this, or did the model decide it while pursuing something else? The record needs the human principal, the agent and its version, the tool, the resource, the policy decision that allowed it, and a correlation id back to the originating turn. This chapter writes it and then reads an incident with it.

   Read chapter