Bounded Agents introduces the Agentic Principal Chain (APC), an authorization model for multi-agent AI systems.</p>\n<p>APC carries authorization state across actions, agents and tools, narrows scope and budgets through delegation, and uses prior execution history when deciding whether a new action should be allowed. Enforcement remains outside the model.</p>\n<p>Across 3,154 evaluation instances, APC reduced AgentDojo exfiltration from 75–100% to 0% across all four domains, destruction from 38.6% to 4.0%, and manipulation from 90.5% to 12.1%. It blocked all 544 InjecAgent data-stealing cases and all disruptive Agent Security Bench cases, while validating 99/99 delegation chains from 2 to 8 hops. Authorization latency was 0.24 ms at the 99th percentile.</p>\n","updatedAt":"2026-08-20T17:29:12.997Z","author":{"_id":"64d3c8fedae613392cbfc534","avatarUrl":"/avatars/f9520b06101a2a852bbce51b10b12497.svg","fullname":"Xabier Muruaga","name":"xmuruaga","type":"user","isPro":false,"isHf":false,"isHfAdmin":false,"isMod":false,"followerCount":2,"isUserFollowing":false}},"numEdits":1,"identifiedLanguage":{"language":"en","probability":0.8687992095947266},"editors":["xmuruaga"],"editorAvatarUrls":["/avatars/f9520b06101a2a852bbce51b10b12497.svg"],"reactions":[{"reaction":"🚀","users":["xmuruaga"],"count":1}],"isReport":false}}],"primaryEmailConfirmed":false,"paper":{"id":"2608.15888","authors":[{"_id":"6a86f85475f45c1c607db431","user":{"_id":"64d3c8fedae613392cbfc534","avatarUrl":"/avatars/f9520b06101a2a852bbce51b10b12497.svg","isPro":false,"fullname":"Xabier Muruaga","user":"xmuruaga","type":"user","name":"xmuruaga"},"name":"Xabier Muruaga","status":"claimed_verified","statusLastChangedAt":"2026-08-20T16:45:04.565Z","hidden":false}],"mediaUrls":["https://cdn-uploads.huggingface.co/production/uploads/64d3c8fedae613392cbfc534/7uyWiVk1UXRKYketD7hFX.png","https://cdn-uploads.huggingface.co/production/uploads/64d3c8fedae613392cbfc534/PvpMfYs4VoFebnrreTyut.png","https://cdn-uploads.huggingface.co/production/uploads/64d3c8fedae613392cbfc534/F23ruslz_-YNQcHUp288H.png"],"publishedAt":"2026-08-16T00:00:00.000Z","submittedOnDailyAt":"2026-08-20T00:00:00.000Z","title":"Bounded Agents: Delegation Security for Multi-Agent AI Systems","submittedOnDailyBy":{"_id":"64d3c8fedae613392cbfc534","avatarUrl":"/avatars/f9520b06101a2a852bbce51b10b12497.svg","isPro":false,"fullname":"Xabier Muruaga","user":"xmuruaga","type":"user","name":"xmuruaga"},"summary":"LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.","upvotes":2,"discussionId":"6a86f85475f45c1c607db432","projectPage":"https://muruaga.ai/bounded-agents/evaluation","githubRepo":"https://github.com/xmuruaga/bounded-agents","githubRepoAddedBy":"user","ai_summary":"The Agentic Principal Chain enforces session-aware authorization checks to prevent harmful action combinations and delegation abuses in LLM agents.","ai_keywords":["Agentic Principal Chain","authorization architecture","delegated authority","composition closure","Blast Radius Monotonicity","Composition Soundness","prompt injection","session state","intent binding"],"ai_summary_model":"thinkingmachines/Inkling-Small","githubStars":2},"canReadDatabase":false,"canManagePapers":false,"canSubmit":false,"hasHfLevelAccess":false,"upvoted":false,"upvoters":[{"_id":"64d3c8fedae613392cbfc534","avatarUrl":"/avatars/f9520b06101a2a852bbce51b10b12497.svg","isPro":false,"fullname":"Xabier Muruaga","user":"xmuruaga","type":"user"},{"_id":"63ac5701c21e60a3e9b58aa7","avatarUrl":"https://cdn-avatars.huggingface.co/v1/production/uploads/63ac5701c21e60a3e9b58aa7/g6EX7diOpuA94R2ab-rZC.png","isPro":true,"fullname":"Dipankar Sarkar","user":"dipankarsarkar","type":"user"}],"acceptLanguages":["en"],"dailyPaperRank":0,"markdownContentUrl":"https://huggingface.co/buckets/huggingchat/papers-content/resolve/2608/2608.15888.md","query":{}}">
Bounded Agents: Delegation Security for Multi-Agent AI Systems
Abstract
The Agentic Principal Chain enforces session-aware authorization checks to prevent harmful action combinations and delegation abuses in LLM agents.
LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.
Community
Bounded Agents introduces the Agentic Principal Chain (APC), an authorization model for multi-agent AI systems.
APC carries authorization state across actions, agents and tools, narrows scope and budgets through delegation, and uses prior execution history when deciding whether a new action should be allowed. Enforcement remains outside the model.
Across 3,154 evaluation instances, APC reduced AgentDojo exfiltration from 75–100% to 0% across all four domains, destruction from 38.6% to 4.0%, and manipulation from 90.5% to 12.1%. It blocked all 544 InjecAgent data-stealing cases and all disruptive Agent Security Bench cases, while validating 99/99 delegation chains from 2 to 8 hops. Authorization latency was 0.24 ms at the 99th percentile.
Upload images, audio, and videos by dragging in the text input, pasting, or clicking here.
Tap or paste here to upload images
Cite arxiv.org/abs/2608.15888 in a model README.md to link it from this page.
Cite arxiv.org/abs/2608.15888 in a dataset README.md to link it from this page.
Cite arxiv.org/abs/2608.15888 in a Space README.md to link it from this page.
Discussion (0)
Sign in to join the discussion. Free account, 30 seconds — email code or GitHub.
Sign in →No comments yet. Sign in and be the first to say something.