Bounded agents expose a compositional risk in AI authorisation

At a glance

What this is: This is an analysis of agent authorization design and its key finding is that harmful outcomes emerge when individually permitted actions combine into a forbidden result.

Why it matters: It matters because IAM, NHI, and AI governance teams must control the authority chain, not just the single request, when agents can chain tool use, delegation, and session context.

By the numbers:

• Across 3,154 instances from public benchmark suites, AgentDojo exfiltration fell from a range of 75 to 100 percent to zero in all four domains.
• Across 949 task-injection pairs, task utility landed 8.6 and 13.9 percentage points lower in the two settings tested.
• All 544 InjecAgent data-stealing cases were blocked.

👉 Read Cakewalk's analysis of bounded agents and AI authorization risk

Context

Agent authorization breaks when a system evaluates each action in isolation and misses what the session becomes after multiple permitted steps. In AI agent governance, the real question is not whether one request is allowed, but whether the accumulated path of approved actions can produce a prohibited outcome.

This article focuses on compositional risk in agentic AI and the delegation chain that connects a human initiator, the primary agent, sub-agents, and tools. That is a different problem from model alignment, because the failure sits in the authority model itself, not in whether the model understands the prompt.

For practitioners, the starting assumption is already under strain: if the session can preserve authority across hops, then least privilege at the first decision point may still permit a later policy violation. That is now a typical design gap in agentic systems, not an edge case.

Key questions

Q: What breaks when an AI agent can use allowed actions incorrectly?

A: The break is in the assumption that permission equals safety. If an agent can chain valid actions into the wrong outcome, traditional access control no longer captures risk. Security teams need runtime checks for task alignment, confidence, and reversibility before high-impact actions execute, especially where the actor can improvise under uncertainty.

Q: Why do AI agents complicate least-privilege design?

A: AI agents complicate least-privilege design because their tool use can change dynamically while the underlying permissions remain persistent. The system may need broad enough access to complete a task, but that same access can overshoot if scope is not tightly controlled. The fix is task-scoped authorisation with clear boundaries, not wider standing access.

Q: What do security teams get wrong about prompt injection defence?

A: They often assume better blocklists will solve the problem, but obfuscation simply changes the shape of the payload. Real defence requires examining meaning across the full interaction, including retrieved content and model responses. If the control cannot interpret intent, it will keep missing the attack class it is meant to stop.

Q: How should organisations govern agent-to-agent delegation?

A: They should treat delegation as a formal governance boundary, not just an integration pattern. That means defining what data can move between agents, how inherited permissions are recorded, and when delegated actions require review. Without that, one agent can extend another's access in ways the original control model never saw.

Technical breakdown

Why session-start authorization misses agentic AI risk

A session-start policy checks the first request against current permissions, then assumes the rest of the interaction stays within that boundary. In agentic systems, the session can accumulate context, invoke tools, and pass authority across sub-agents, so a later action may be individually allowed while the combined outcome is not. That is why prompt injection is not the root issue on its own. The real failure is authorization design that does not evaluate the whole delegation path and therefore cannot detect compositional risk.

Practical implication: evaluate authorization at the session and delegation level, not only at the single-action level.

Delegation chains and blast radius in AI agents

A delegation chain is the sequence of principals and tools that carry authority from the original user to the final action. If a sub-agent inherits permissions without narrowing them, the blast radius expands even when each hop looks acceptable in isolation. This is especially important in multi-agent workflows where one component reads data, another sends messages, and a third can forward context or credentials. The architectural lesson is that authority must shrink, not expand, as it moves through the chain.

Practical implication: design sub-agent handoffs so authority is narrowed at every hop.

Compositional risk in permitted actions

Compositional risk is the security exposure created when individually permitted actions combine into an outcome the policy would have rejected if seen end to end. This is not the same as a single permission failure, because no one control may be wrong in isolation. In agentic AI, that means reading confidential data and sending an external message can each be legitimate, yet the sequence can still violate policy. Traditional RBAC and ABAC remain useful, but they need a view of cumulative behavior to be effective.

Practical implication: add aggregate-policy checks that reason over action sequences, not just action types.

Threat narrative

Attacker objective: The attacker wants the agent to assemble permitted capabilities into an outcome the policy would not have allowed directly.

1. Entry occurs when an attacker gets a prompt injection or similar adversarial instruction into an agent that already holds useful authority. Escalation happens when the agent combines individually permitted actions, or passes authority to a sub-agent without narrowing it. Impact occurs when that combined path produces a prohibited result such as data exfiltration or unauthorized external communication.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Compositional risk is now the right name for a class of agentic failures that IAM teams already understand in other forms. The problem is not that a single permission is wrong, but that permitted actions become unsafe when evaluated together across a session. That makes the policy boundary a sequence problem, not a point-in-time problem, and it moves agent governance closer to access-path analysis than to model trust. Practitioners should treat the combined outcome as the unit of control.

Session-start authorization was designed for requests whose risk is visible at the moment of approval. That assumption fails when an AI agent can accumulate context, invoke tools, and combine permissions into a later prohibited result. The implication is that existing IAM thinking about static scopes and fixed approval gates is incomplete once the actor can recompose authority at runtime.

Authority must now be understood as a delegation chain, not a single entitlement. In agentic systems, the human, the primary agent, the sub-agent, and the tool can each preserve or enlarge the blast radius if the handoff is not constrained. That makes accountable design depend on where authority narrows, where it is inherited, and where it silently expands.

Prompt injection is still a delivery mechanism, but the underlying failure is authorization architecture. The article is clear that better model robustness alone does not solve a policy problem created by how access is granted and propagated. This pushes AI security teams toward authorization models that inspect cumulative behavior and not just prompt content.

Bounded Agents is best read as a warning against treating agentic systems like ordinary automation. Automation follows a script, while agents can choose sequences within their authority, which means the control objective shifts from execution correctness to authority containment. Practitioners should redesign governance around decision paths, not just tool lists.

From our research:

• Across 3,154 instances from public benchmark suites, AgentDojo exfiltration fell from a range of 75 to 100 percent to zero in all four domains, according to the AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That gap makes delegation-chain controls a natural next step for readers of OWASP Agentic Applications Top 10 and other agent governance guidance.

What this signals

Compositional risk: agent governance now needs a policy layer that evaluates what a session becomes, not only what each step is allowed to do. For practitioners, that means mapping the authority chain into IAM and PAM controls so a permitted action cannot be recombined into an unauthorized result. A useful companion reference is the OWASP Top 10 for Agentic Applications 2026.

The practical signal for programmes is that agent controls will increasingly resemble identity governance for NHI, not simple application allowlists. Once an agent can chain tools and sub-agents, the security question becomes how far authority can travel before it is forced to narrow.

With 92% of organisations saying governing AI agents is critical but only 44% having policies in place, per the AI Agents: The New Attack Surface report, the gap is governance maturity rather than technical awareness.

For practitioners

• Map delegation chains end to end Document the full path from human initiator to primary agent, sub-agent, and tool so you can see where authority is inherited instead of narrowed. Focus on the points where one principal can hand off context or permissions without a new decision boundary.
• Evaluate cumulative outcomes, not isolated requests Add policy checks that assess what a sequence of approved actions can produce together, especially when reading data and sending data are both separately allowed. This is the control that exposes compositional risk.
• Constrain sub-agent authority at each hop Require explicit narrowing when one agent delegates to another, and block any handoff that preserves the original blast radius by default. Treat inherited permissions as a design defect unless the reduced scope is visible and justified.
• Review session-scoped approval logic Test whether your current approval gates assume a single decision point at session start. If they do, identify where runtime context can alter the outcome after the initial allow decision has already been made.

Key takeaways

• Agentic risk emerges when individually permitted actions are evaluated in aggregate and still produce a prohibited outcome.
• The evidence points to a real governance gap, with benchmarked exfiltration dropping to zero while utility still fell 8.6 to 13.9 points.
• Practitioners should redesign authorization around delegation chains and cumulative outcomes, because session-start approval is no longer enough.

Key terms

• Compositional Risk: The security risk that emerges from combining individually acceptable components into an unsafe end-to-end workflow. In MCP and agentic environments, the danger is often not a broken server but a delegation path that lets untrusted input influence privileged action.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Session-Start Authorization: A policy pattern that approves access based on the conditions present when a session begins. It is useful for simple workflows, but it becomes fragile when an agent can change the effective risk later by chaining approved actions into an outcome the policy would reject.

What's in the full article

Cakewalk's full article covers the operational detail this post intentionally leaves for the source:

• The specific authorization model the preprint proposes for evaluating session history across multiple agent actions.
• The benchmark setup behind the 3,154 test instances and how exfiltration was blocked across the four domains.
• The paper's own boundary conditions, including where the model complements ABAC and RBAC rather than replacing them.
• The delegation-chain interpretation of authority flow from human initiator to sub-agent and tool.

👉 Cakewalk's full article covers the delegation-chain model, benchmark results, and policy boundary analysis.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or programme maturity, it is worth exploring.