Authorization propagation exposes the gap in request-level AI controls

At a glance

What this is: This is an analysis of authorization propagation, the problem of maintaining authorization invariants across multi-agent AI workflows, and its key finding is that request-level access control is not enough.

Why it matters: It matters because IAM, PAM, and NHI teams now have to govern chains of delegated actions, not just individual requests, or they will miss how authority widens, persists, or gets recombined across AI workflows.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials.
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.
• 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.

👉 Read TruFoundry's analysis of authorization propagation in AI gateways

Context

Authorization propagation is the problem of preserving authorization across a workflow as non-human principals retrieve data, delegate tasks, and synthesize results across changing boundaries. In multi-agent systems, the security question shifts from who may make a single request to whether the whole chain still stays inside the authority that existed at the start.

The reason this matters for identity governance is that request-level controls were built for discrete access checks, not for chains that can widen authority hop by hop or combine permitted data into an unapproved whole. In AI gateway environments, the control plane has to carry the originating principal’s authority forward without assuming the workflow itself remains stable.

TruFoundry’s analysis uses the term to describe a gap that sits between authentication, authorization, and workflow orchestration. The article is about a structural governance problem, not a prompt attack, and it reflects the current state of enterprise AI estates where delegated operations, tool calls, and synthesis now happen faster than classic review cycles can observe.

Key questions

Q: How should security teams govern AI agent authorization in distributed systems?

A: Security teams should govern AI agent authorization as a per-request decision problem, not a one-time entitlement. That means enriching each request with identity, resource, and relationship data, then enforcing policy at the tool or protocol boundary. The goal is consistent access control across apps, APIs, queues, and data platforms, with audit logs that show exactly what drove each decision.

Q: Why do traditional RBAC and ABAC controls fall short for AI agents?

A: They usually assume one stable identity making one request at a time. Agent workflows can span tools, sub-agents, and long-running tasks, so the original intent can drift while the identity remains valid. That makes static entitlements too blunt unless they are paired with delegation-aware policy and expiry.

Q: What breaks when an agent can delegate work to another agent?

A: When one agent delegates to another, the accountability chain becomes part of the security problem. If the downstream service cannot see the original authority, it cannot tell whether the action was properly inherited, expanded, or misused. That makes delegation governance necessary for review, audit, and incident investigation.

Q: Who is accountable when a multi-agent workflow exceeds its authority?

A: Accountability sits with the organisation that defined the operating model and the control plane that enforced it. If delegation, token lifetime, and review logic do not reflect workflow-level behaviour, then the policy design failed, even if each individual request looked valid.

Technical breakdown

Transitive delegation in multi-agent AI workflows

Transitive delegation happens when an authorised agent passes work to another agent, which then passes work again, creating a chain where effective authority can widen at each hop. Classical RBAC and ABAC checks can approve each request individually while missing the cumulative effect of delegation. In AI gateways, this becomes a control-plane problem because the downstream call may inherit, combine, or amplify permissions that were never intended for the final actor.

Practical implication: govern delegated tool calls at the gateway boundary so downstream execution never silently accumulates more authority than the originating principal was granted.

Aggregation inference and authorised synthesis

Aggregation inference is the failure mode where each retrieval is individually allowed, but the final synthesis reveals something no single principal was entitled to see. This is common in research, support, and agentic reporting workflows where AI systems combine small, valid fragments into a higher-sensitivity conclusion. The danger is not one bad query but a legitimate sequence that produces an unlicensed whole.

Practical implication: treat the workflow output as a governed artefact, not just the input requests, and review whether the synthesised result exceeds the cleared scope.

Temporal validity for long-running agent workflows

Temporal validity asks whether an authorisation that was valid at the start is still valid at step forty, after a token revocation, role change, or policy update. Long-running AI workflows break the assumption that access can be checked once and trusted for the rest of the session. In practice, this makes short-lived credentials and continuous validation central to non-human identity governance.

Practical implication: align token lifetime and revocation semantics with workflow duration so a grant can fail mid-chain instead of surviving past its intended window.

NHI Mgmt Group analysis

Authorization propagation is the right term because it names a workflow-level failure, not a request-level one. Enterprises have spent years perfecting policies that answer whether a principal may make a single call, but multi-agent systems now require assurance that authority survives the entire chain without widening. That is a different governance unit, and it belongs to identity architecture rather than application logic. Practitioners should treat the workflow as the security boundary, not the request.

Request-level controls fail because they cannot observe cumulative authority. RBAC, ABAC, and ReBAC remain useful inputs, but they do not tell you whether delegated hops, retrieval sequences, and synthesis steps together remain inside the original grant. This is where identity governance becomes infrastructure: the control plane must enforce scope, provenance, and revocation at the point where non-human principals move work between systems. Teams should re-evaluate where policy enforcement actually occurs.

Temporal validity is a governance assumption that breaks under long-running AI execution. Access review models assume there is a stable permission state long enough to be inspected, certified, and revoked. That assumption weakens when an agent can continue operating after the human who initiated it has left the session or after the original token has aged out. Practitioners should redesign review logic around live authority, not static snapshots.

Authorization propagation is a distinct NHI governance concept, not just a new label for prompt injection. Prompt injection is adversarial manipulation, but propagation failures can occur with no attacker at all because ordinary delegation and synthesis create the exposure. That distinction matters for IAM leads because the incident class may be architectural rather than malicious. Security programmes should classify the risk as chain governance, not content safety.

Gateway-enforced delegation is becoming the practical control point for agent estates. If a platform can carry the originating principal, narrow task scope, and keep credentials short-lived, it gives operators a place to enforce invariants that scattered agents cannot reliably maintain themselves. The field is moving toward identity governance as infrastructure, and teams should align their operating model to that reality before agent sprawl makes the gap harder to close.

From our research:

• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• For a deeper framework view, see OWASP Agentic AI Top 10 and compare it with NIST AI Risk Management Framework.

What this signals

Authorization propagation gives IAM teams a better operating lens for agent estates. The practical shift is from single-request approval to chain-level assurance, where delegation, synthesis, and token lifetime are governed together. As agent adoption grows, the organisations that can prove authority narrowing across hops will have a materially stronger position than those that only inspect endpoint permissions.

The next control gap is not visibility alone, but reviewability. If your programme cannot reconstruct which principal held which authority at which hop, then recertification and incident response will both fail to answer the same question. That is why gateway traces, scoped delegation, and lifecycle-linked token governance should be treated as core identity infrastructure.

Identity governance as infrastructure will become a design requirement, not a refinement. Multi-agent systems force non-human identity controls into the control plane because the application layer cannot reliably preserve invariants by itself. Teams should expect more demand for governed delegation patterns, audit-ready traces, and policy enforcement that follows the workflow rather than the user session.

For practitioners

• Define the workflow as the unit of authorisation Map every mediated agent flow from initial request through delegation, retrieval, and synthesis so policy is evaluated against the whole chain, not a single API call.
• Constrain delegated authority at the gateway boundary Require downstream calls to inherit only the originating principal’s scoped authority, and prevent spawned agents from widening access as they branch into subtasks.
• Shorten token lifetime to match task duration Use short-lived, centrally revocable credentials so a grant can expire while a workflow is still running instead of surviving until session end.
• Review synthesis outputs as governed artefacts Track whether a workflow’s combined output reveals more than any single retrieval or delegation step was cleared to expose, especially in research and support workflows.
• Audit whether access review still fits the operating model Check whether your recertification and offboarding routines assume stable human-paced access states, because that assumption no longer holds for multi-agent execution.

Key takeaways

• Authorization propagation is the structural problem behind multi-agent AI governance, because it measures whether authority survives a workflow without widening.
• Evidence from current research shows that AI agent governance is already lagging adoption, visibility, and policy coverage.
• Practitioners should move policy enforcement to the gateway and treat delegation, synthesis, and token lifetime as one control problem.

Key terms

• Authorization Propagation: Authorization propagation is the time it takes for a membership or role change to become effective across the systems that enforce access. In practice, it determines whether the policy state and the runtime state agree. Slow propagation creates stale access windows that identity teams must treat as a governance risk, not a convenience issue.
• Transitive Delegation: Transitive delegation is the widening risk that appears when one agent passes work to another and authority is carried forward, intentionally or not. Each hop can expand the effective permission set if scope is not narrowed. In practice, it is a control problem for delegation chains, not just for individual principals.
• Aggregation Inference: Aggregation inference is the exposure created when individually permitted data points are combined into a result that no one was cleared to see. The underlying requests may all be authorised, but the output crosses a sensitivity boundary. This is especially relevant in research, support, and synthesis workflows.
• Temporal Validity: Temporal validity is the requirement that a grant remain valid for the exact time it is used, not just when a workflow begins. In long-running agent systems, roles change, tokens expire, and permissions are revoked while execution continues. Identity governance has to check live authority, not historical approval.

What's in the full article

TruFoundry's full article covers the operational detail this post intentionally leaves for the source:

• The paper-level explanation of transitive delegation, aggregation inference, and temporal validity in multi-agent systems.
• The seven structural requirements the article attributes to architectures that preserve authorization invariants.
• The gateway-level implementation pattern for per-user delegation and task scoping across registered operations.
• The discussion of where chain traces help audit review and where they do not decide authorization by themselves.

👉 TruFoundry's full article covers the chain-level delegation model, workflow invariants, and implementation details.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.