Bounded agents expose a compositional risk in AI authorisation

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Cakewalk's blog post: Prompt injection becomes harmful when an AI agent can combine permitted actions into a prohibited result within one session.

Why it matters: IAM and security teams need to treat delegated AI actions as an accumulated authority problem, because static permission checks miss outcomes that emerge only across a chain of allowed steps.

By the numbers:

• Across 3,154 synthetic instances, AgentDojo exfiltration fell from 75 to 100 percent to zero in all four domains.

Context

Compositional risk is the gap between what an AI agent is allowed to do in isolation and what it can achieve by combining allowed actions. In this article, the governance problem sits squarely in AI authorisation: session-start permissions are judged too early to see a harmful sequence form inside the same delegation chain.

That matters because prompt injection is not framed here as a model-quality problem. The article argues that the security failure appears when authority already exists somewhere in the chain, so the relevant question for practitioners is how far delegated permissions can travel before they become a prohibited outcome.

The article is based on a preprint and synthetic benchmark results, so the operational lesson is structural rather than empirical proof of production prevalence. Even so, the author’s central claim is clear: access decisions that ignore accumulated actions understate the real blast radius of agent delegation.

Key questions

Q: What breaks when AI agents can combine permitted actions into a forbidden outcome?

A: Session-start authorisation breaks because it evaluates each action in isolation and misses harmful combinations that emerge later in the same delegation chain. A policy may correctly permit reading a document and sending a message, yet still fail when those actions together produce data exfiltration or another forbidden result. The control needs to understand accumulated authority, not just individual permissions.

Q: Why does compositional risk increase when delegated agent actions are chained together?

A: Because each hop can preserve or expand authority, and the security outcome depends on the total sequence rather than any single request. A chain that begins with a legitimate task can still drift into prohibited territory if later steps inherit too much scope or combine prior permissions in unsafe ways. That is why blast radius has to be evaluated across the full chain.

Q: How do security teams know if agent authorization is actually working?

A: Authorization is working only if the agent can complete the intended task without gaining unnecessary reach. Good signals include short-lived credentials, task-scoped permissions, approval for sensitive changes, and clear logs linking each action to a user and an agent. If credentials are reused, privileges persist, or the agent can move between systems without reauthorization, the control is failing.

Q: What should teams do when an AI agent is suspected of prompt injection?

A: Contain the session, revoke the agent’s active credentials, and inspect the full chain of tool calls, retrieved content, and downstream writes before resuming service. The priority is to stop the agent from completing additional actions and to determine whether the malicious instruction has already propagated into memory or connected systems.

Technical breakdown

Why session-start permission checks miss composite agent outcomes

The core mechanism is simple: each step may be individually allowed, yet the sequence of steps can still produce a forbidden result. In bounded-agent authorisation, the system evaluates requests against what the session has already done, which makes the accumulated action path part of the decision context. That is a different problem from model alignment, because the model can behave as instructed and still exercise authority in a way the policy did not intend. The technical issue is not a single broken permission, but the interaction between permitted actions and the order in which they are chained.

Practical implication: Design authorisation to evaluate action combinations, not just individual requests.

Delegation chains and blast radius in multi-agent systems

The article treats the delegation chain as the run of principals from the human requester through sub-agents and tools. Each hop can inherit authority, but no hop should increase the blast radius beyond what the original task requires. That means the security boundary is not the LLM prompt alone, nor the individual sub-agent alone, but the authority flow across the whole execution path. This is especially important when a sub-agent can pass authority onward without narrowing scope, because the chain can accumulate enough privilege to reach an outcome that no single actor was ever meant to hold.

Practical implication: Track and constrain authority transfer at every hop in the agent chain.

ABAC and RBAC still need session-aware enforcement

The article says the approach complements RBAC and ABAC rather than replacing them. That distinction matters because traditional role or attribute checks often answer whether a principal may do one thing, not whether several permitted things become unsafe together. In agent settings, the decision surface must consider current session state, prior tool use, and the combined effect of downstream actions. Without that, authorisation remains blind to composition even if the underlying permissions are formally correct. The result is a policy that is locally valid but globally unsafe.

Practical implication: Extend RBAC and ABAC decisions with session context and cumulative action review.

Breaches seen in the wild

• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.
• EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Compositional risk is the right security label for agent authorisation failures. The article shows that the problem is not whether one action is allowed, but whether allowed actions can be assembled into a forbidden result. That shifts the analytical unit from individual requests to the delegation chain as a whole. Practitioners should treat agent authorisation as an accumulation problem, not a single-decision problem.

Session-start permissions were designed for static authority, not accumulating agent behaviour. That assumption fails when an agent can select, sequence, and combine permitted actions inside one task. The implication is that access models built for isolated requests no longer describe the security boundary accurately, especially once sub-agents and tools inherit partial authority.

Prompt injection is only one trigger for a deeper governance flaw. The article makes clear that the harmful condition is pre-existing authority, not the injected text itself. That means the control gap is over-permissive delegation, not merely malicious input handling. Practitioners should focus on where authority can be combined, handed on, or amplified across agent steps.

Blast radius must become a first-class authorisation variable for AI agents. The paper’s emphasis on no hop growing the blast radius captures the real governance issue: each additional delegated action can enlarge the damage even when every step is individually permitted. This is where agent governance diverges from conventional workflow automation. Security teams should measure how authority expands across the chain, not just who authenticated at the start.

Benchmark gains do not remove the production governance question. The results show structural promise, but they are synthetic and deliberately scoped. That means the field still needs mature policy models for real deployments where task context, human intent, and delegated authority drift over time. Practitioners should use the finding to sharpen governance design, not to assume the problem is solved.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Authorisation Guide

What this signals

Compositional authority needs to replace single-step thinking in AI governance. If an agent can make several allowed moves that only become harmful in combination, then policy design has to track execution paths, not just permission grants. That is a material shift for teams trying to govern delegated AI with controls built for human-paced requests.

Session review is the wrong checkpoint when authority can accumulate mid-task. Many identity programmes assume there will be a stable artefact to review after the fact, but agentic systems can create the harmful condition during execution. The programme response is to inspect authority flow before a task can compound into a prohibited result.

AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026. That trend reinforces the broader lesson here: the blast radius around AI systems is widening faster than static authorisation models can keep pace.

For practitioners

• Map authority across the delegation chain Document which permissions each agent, sub-agent, and tool inherits, and flag any path where a later step can combine earlier permissions into an outcome the original policy would forbid.
• Enforce cumulative-session authorisation Require policy decisions to consider prior actions in the same session so that a harmless first step cannot become dangerous only after subsequent permitted steps.
• Constrain sub-agent authority transfer Prevent sub-agents from passing on broader authority than they received, and treat any authority handoff as a separate governance event.
• Measure blast radius at each hop Evaluate whether each additional call, tool use, or delegation expands the possible impact of the session beyond the original task objective.
• Review RBAC and ABAC for session context Test whether role and attribute rules still hold when multiple allowed actions are combined inside a single task rather than requested one by one.

Key takeaways

• The article frames agent authorisation as a compositional problem, where individually permitted actions can still produce a prohibited outcome.
• Its benchmark results show that structural controls can block exfiltration cases, but the test environment is synthetic and the trade-off is lower task utility.
• The practical control lesson is to evaluate accumulated authority across delegation chains, because session-start permissions alone cannot see harmful combinations.

Key terms

• Compositional Risk: The security risk that emerges from combining individually acceptable components into an unsafe end-to-end workflow. In MCP and agentic environments, the danger is often not a broken server but a delegation path that lets untrusted input influence privileged action.
• Delegation Chain: A delegation chain is the sequence of identities, credentials, and tool calls an agent uses to complete a task across systems. It matters because each step may appear acceptable on its own while the combined path produces an outcome no reviewer would have approved directly.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Session-Aware Authorisation: Session-aware authorisation evaluates a request using the state of all relevant active contexts, not just the current login session. It is a control pattern for environments where concurrency can change the meaning of a single approved action.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.