Prompt filtering only reduces bad input. It does not prove who authorised the action, what scope was approved, or whether the agent reused a human identity to complete the task. A production agent needs a verifiable chain of authority that binds the request, the actor, and the allowed action before any tool call happens.
Why prompt filtering is only the first line of defence
Prompt filtering helps reduce malicious or malformed input, but it does not answer the control question that matters in production: who is allowed to act, on whose behalf, and under what scope. An AI agent can receive a harmless prompt and still perform a high-impact action if its runtime privileges are too broad or if it can reuse a human session or token.
The real security boundary is not the text the model sees, it is the authority the agent is permitted to exercise. That is why agent security has to separate content safety from action safety. A system that blocks bad prompts but allows uncontrolled tool calls still leaves a direct path from input to consequence.
That distinction is why least privilege, task scoping, and explicit approval gates matter for AI Agent Authorisation Guide, which focuses on per-action policy decisions rather than treating every request as equally trusted.
What identity and delegation add that filters cannot
Identity tells the system which principal is acting. Delegation tells it what that principal is allowed to do on behalf of another principal, and for how long. Together they create a verifiable chain of authority that binds request, actor, and action before the tool call happens.
That chain matters because many agent failures are not content problems, they are authority problems. If an agent can borrow a human identity, inherit a session, or reuse a standing token, then prompt filtering has no way to distinguish an approved workflow from an unauthorized escalation. A proper delegation design makes the approval context machine-checkable instead of relying on the prompt to carry policy.
For teams still defining the model, Agentic AI Identity Guide is the clearest starting point because it explains how agents get, use, and lose identities, while Zero Trust for AI Agents shows how to verify the agent, principal, and request every time rather than trusting a previous step.
How to think about agent authority in practice
Production agents should be designed around bounded authority, not just safer language. The useful questions are whether the request was approved, whether the approval is still valid, whether the agent may act only for a specific task, and whether the action can be attributed after the fact. That is the operational difference between a chatbot and an agent with execution power.
When identity is weak, prompt injection becomes more dangerous because the attacker is not only trying to shape output, but to steer an authenticated actor into performing an unauthorized action. When delegation is weak, even a legitimate task can cross environment boundaries, exceed its intended scope, or outlive the approval that created it. In practice, those are governance failures as much as security failures.
Agentic AI Security Guide and Top 10 Agentic AI Identity Issues both frame this as a control problem, not a prompt-quality problem, while AI Agent Observability, Audit and Incident Response Guide is useful once you need to prove what the agent actually did.
Risk and Threat Considerations
Prompt filtering alone leaves a gap between input validation and action authorization. If an agent can act with inherited human credentials, stale sessions, or overbroad permissions, an attacker only needs a successful influence step, not a full compromise of the model itself.
Failure mechanism: The system treats a filtered prompt as sufficient trust evidence, so the agent can still invoke tools, transfer tokens, or execute destructive actions without a fresh authorization decision tied to the specific request and scope.
Impact: The result can be unauthorized data access, unintended operational changes, privilege escalation, or misuse of a human identity that is difficult to detect after the fact.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agent identity and delegated authority are central to controlling action scope. |
| Recommendation — Enforce per-action authorization and least privilege for every agent tool call. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Non-Organizational Users) | Agent and service-to-service authentication need distinct trust before tool use. |
| AC-6 — Least Privilege | Delegation controls must constrain what an agent may do after authentication. | |
| Recommendation — Require machine-to-machine authentication for agent execution paths and delegated access. Limit agent permissions to the minimum scope needed for the current task. | ||
| OWASP ASVS | V10 — OAuth and OIDC | Delegated identity flows for agents rely on secure token exchange and consent handling. |
| Recommendation — Use secure delegated token flows and validate authorization context before action. | ||
Practitioner Guidance
What to prioritise: Bind every meaningful tool call to an explicit principal, a bounded scope, and a current approval state. If the agent cannot prove those three elements, the request should be treated as untrusted even if the prompt is clean.
What to verify: Check whether the agent is using a dedicated identity, whether delegated authority is time-limited and task-limited, and whether human credentials are ever being reused to complete agent actions. That is the fastest way to tell whether you have real delegation or just prompt-side control.
Practitioner takeaway: The security objective is not to make prompts safer, it is to make authority explicit, limited, and auditable before the agent can change anything.