The resource loses the ability to evaluate the request against the true authoriser, not just the last agent in the path. That breaks accountability, complicates incident reconstruction, and makes policy enforcement depend on incomplete context. In practice, provenance has to survive every hop or the chain is no longer governable.
When delegation loses the original caller, what exactly stops working?
The chain still moves requests, but it stops carrying the decision-making context that explains who initiated the action and under what authority. That means downstream systems can no longer evaluate policy against the true actor, only against the most recent hop. The failure is not just technical trace loss, it is a loss of governability.
In practical terms, the resource cannot distinguish a delegated action from a locally originated one unless provenance survives each handoff. For agentic systems, that distinction is what makes consent, scope, and responsibility auditable rather than inferred after the fact.
How provenance loss changes authorisation and audit logic
Delegation is only safe when the receiving service can preserve or reconstruct the original caller, the delegated actor, and the chain of custody between them. If that context is stripped away, policy engines may grant or deny based on the last agent in line, which creates false trust and can also block legitimate on-behalf-of requests. A useful reference point is RFC 8693: OAuth 2.0 Token Exchange, which formalises token exchange for delegation and impersonation flows.
This is why provenance is more than an audit field. It is part of the authorisation input set. Without it, every hop becomes a potential context reset, and the system quietly shifts from evaluating “who asked” to evaluating only “who forwarded”.
For multi-agent environments, the same issue appears in agent-to-agent handoff. NHIMG’s Agentic AI Identity Guide and Multi-Agent and A2A Security Guide both point to the same operational requirement: delegation chains need explicit identity continuity, not just transport continuity.
Why broken caller preservation turns into a governance problem
Once the original caller is lost, accountability becomes ambiguous because evidence no longer ties an action to the initiating principal. That weakens incident reconstruction, complicates approvals and exception handling, and makes it harder to show whether a policy decision was correct at the time it was made. The result is a control gap, not merely a logging gap.
It also creates a subtle policy drift risk. If every downstream component treats the intermediate agent as the authority, the system may accumulate permissions that were never intended for the original requestor, especially when delegated actions are chained across tools or services. NHIMG’s AI Agent Authorisation Guide is useful here because it centres the decision on per-action authority rather than blanket trust in the agent path.
When the chain is long, operators also need a way to investigate action history without guessing at provenance from logs alone. The AI Agent Observability, Audit and Incident Response Guide is the natural companion for reconstructing who did what, when and under which delegation context.
Risk and Threat Considerations
When original-caller context is dropped, the main risk is trust abuse: a downstream service may treat a delegated request as if it were directly authorised by the intermediary, which expands the blast radius of compromise. In chained-agent environments, that also creates a persistence opportunity because attackers can hide behind apparently legitimate handoffs and make response teams chase the wrong principal.
Failure mechanism: the delegation chain fails to bind the initiating principal to each subsequent action, so policy, logging, and attribution all operate on incomplete context. That allows privilege confusion, weakens approval checks, and can turn a valid delegated pathway into an unauditable proxy for higher-risk activity.
Impact: investigators lose a reliable path back to the true authoriser, controls become harder to enforce consistently, and compromised intermediaries can make their actions look legitimate. At scale, this undermines incident reconstruction and can make enforcement decisions differ by hop rather than by intent.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Broken caller preservation directly enables authority confusion across agent hops. |
| Recommendation — Bind each delegated action to the original principal and enforce per-action authorization. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Service Identification and Authentication | Delegated agent paths require identity continuity between services and actors. |
| AU-3 — Content of Audit Records | Audit records must retain original-caller context to support reconstruction and accountability. | |
| AC-3 — Access Enforcement | Access decisions must use the true authoriser, not only the last hop in a delegation chain. | |
| Recommendation — Require downstream services to verify the authenticating identity behind each delegated request. Record the initiating principal, delegated actor, and scope in each audit event. Enforce access decisions on the initiating principal and delegated scope together. | ||
| NIST Zero Trust (SP 800-207) | Zero Trust Architecture | Continuous verification depends on preserving the principal across every trust boundary. |
| Recommendation — Verify identity and authority at each hop instead of trusting the forwarding path. | ||
Practitioner Guidance
What to verify: confirm that every delegation hop preserves an immutable record of the original caller, the delegated actor, and the scope of authority being exercised. If any hop only exposes the last forwarding agent, treat the chain as incomplete for governance purposes.
Decision rule: if the receiving system cannot evaluate the request against the true authoriser, do not accept the delegation as fully trusted, even when the request appears operationally routine. Escalate to a design that preserves provenance end to end rather than trying to reconstruct it later from logs.
What good looks like: the same request can be traced from initiation through each hop without ambiguity, and policy decisions remain explainable against the original caller as well as the intermediary actors.
Practitioner takeaway: delegation is only governable when authority remains attributable all the way through the chain; once caller identity is lost, you may still have movement, but you no longer have reliable control.
Related resources from NHI Mgmt Group
- What breaks when AI agent chains lose track of the original user and delegated scope?
- What is the difference between human identity governance and AI agent governance?
- When does AI agent access create more risk than it reduces?
- What is the difference between governing human access and governing AI agent access?