An agent identity is more dangerous than its capability

Figure: OWASP Excessive Agency entry (source: genai.owasp.org, captured 2026-10-19)

A confused deputy is a program that has permission to do something and is tricked into doing it for someone else. Agents are confused deputies by design: they hold credentials, they read untrusted content, and they act.

Three paths to over-privilege

1. Delegation: agent A asks agent B to act, and B trusts A’s claim about the user.
2. Memory: a poisoned memory entry changes which tool the agent picks.
3. Forged tool response: a tool returns a message that looks like an instruction from the user.

A fix list

• Give every agent its own scoped token, never the user’s.
• Validate the delegation chain at the receiving end, not just the sender.
• Treat tool output as data, even when it says “user said”.
• Log tool name, arguments, actor and authorization source.

Goal hijacking

An agent is “persuaded” when the content it reads redefines its objective. The fix is not a better prompt; it is a policy layer that checks the action against the original objective before execution.

Four token fields

Subject, scope, audience, expiry. If your agent token lacks any of them, it is a password.

Verifying a delegation chain

Each hop should prove: who is asking, on whose behalf, for what scope. A chain that only passes a user id is not a chain.

Audit fields

Tool, arguments, actor, on-behalf-of, authorization source, result, timestamp. Without these, incident response cannot answer “what did it do”.

Common mistakes

• Trusting the agent’s own claim about permissions.
• Reusing the user’s session token for the agent.
• Treating internal agents as trusted.

My take

Capability is visible; identity is not. Most agent incidents will be identity incidents, and they will look like normal tool calls in the logs.