Identity controls are the structural defence against prompt injection

At a glance

What this is: This is an identity-security analysis of prompt injection that argues the real defence is to place consequential actions behind cryptographic authorization boundaries, not to rely on model prompt hygiene alone.

Why it matters: IAM, PAM, and NHI teams need this framing because agent tool access, delegation, and approval gates must be enforced where authority is granted, especially when AI reasoning can be manipulated.

Context

Prompt injection is a control failure in AI systems that use the same input path for trusted instructions and untrusted content. When a model cannot reliably tell data from direction, any workflow that lets the model decide consequential actions inherits that ambiguity.

For identity programmes, the issue is not whether the model can be persuaded, but whether the system can still enforce scope, delegation, and approval after persuasion succeeds. That moves the security question from prompt quality to authorization architecture, especially for non-human identities and agentic workflows.

The article frames that boundary as structural defence: scope-per-tool access, step-up approval, dual control, and chain-aware delegation all make the dangerous action fail outside the model even when the model's reasoning is compromised.

Key questions

Q: What breaks when prompt injection protections rely only on prompt engineering?

A: Prompt engineering alone breaks down because malicious input is still processed as part of the same text stream as legitimate instructions. Attackers can use role play, encoding tricks, multilingual prompts, or indirect content to bypass guardrails. If the application has no hard boundary between instructions and data, the model may comply with hostile requests anyway.

Q: Why do scope-per-tool tokens reduce prompt injection risk?

A: They reduce risk because the model can only request actions already encoded in the token. If a prompt injection tries to turn a summarization agent into an email sender or deleter, the resource server can reject the call at authorization time. The attacker can influence intent, but not expand the token's authority.

Q: How do teams know when step-up approval is enough and dual control is required?

A: Use step-up approval for moderate-risk actions where a single reviewer can reasonably assess the request, such as sending an external message or updating a customer record. Use dual control when the action is irreversible, high impact, or would be material if prompt-injected. The decision should follow consequence, not convenience.

Q: What is the difference between human-in-the-loop approval and dual control for AI agents?

A: Human-in-the-loop means a human reviews or authorizes an action before it proceeds. Dual control is stricter because it requires two authorized humans to complete a cryptographic approval for a high-impact action. In practice, HITL is for reviewable risk, while dual control is for actions where segregation of duties matters.

Technical breakdown

Why prompt injection breaks model-level trust separation

Prompt injection works because LLMs ingest system instructions, user prompts, and retrieved data through the same context mechanism. The model does not receive a cryptographic signal that says one token stream is authoritative and another is merely content to summarise. That means the model's behaviour is probabilistic, not a trustworthy security boundary. Direct prompt injection enters through user input, while indirect prompt injection hides inside PDFs, emails, web pages, or RAG sources that the agent later consumes. In both cases, the attacker is trying to move the model from interpretation into execution.

Practical implication: Treat the model as untrusted reasoning, and move authority checks to the resource boundary.

Scope-per-tool tokens at the MCP boundary

A scope-per-tool design gives each agent action a distinct authorization claim. The MCP server or downstream resource server checks whether the token includes the exact scope needed for the requested tool, such as read-only summarization versus external email or record deletion. If prompt injection causes the agent to ask for an out-of-scope action, the call fails with insufficient_scope regardless of what the model intended. This is important because it changes the failure mode from silent compromise inside the model to explicit denial at the enforcement point.

Practical implication: Bind every tool to minimal scopes so compromised reasoning cannot expand authority.

Why dual control and step-up stop consequential misuse

High-impact actions need more than a model decision because prompt injection can still misuse a legitimately granted scope. Dual control requires a second authorized human to complete a cryptographic approval ceremony for irreversible or high-impact actions. Step-up approval is a lighter pattern for moderate-risk actions, where the originating user must re-authorize the action at the moment of execution. Both patterns place the final decision outside the LLM, so the model can propose or initiate but cannot execute alone.

Practical implication: Route irreversible or high-risk actions through approval gates the model cannot bypass.

Threat narrative

Attacker objective: The attacker wants the agent to misuse legitimate delegated authority to exfiltrate data, trigger destructive actions, or carry out unauthorized external communication.

1. Entry occurs when malicious instructions are embedded in content the agent is already expected to process, such as a document, email, or retrieved web page.
2. Credential or authority abuse follows when the agent's valid scopes are reused for an unintended action that the attacker has steered the model toward.
3. Escalation happens when the action crosses from summarisation or retrieval into outbound communication, deletion, or other consequential execution without a separate authorization boundary.
4. Impact is achieved when the agent completes the harmful action using its own delegated authority, often with little visible difference from normal workflow traffic.

Breaches seen in the wild

• Gemini CLI prompt injection flaw 2025: Tracebit showed a poisoned README could make Gemini CLI run hidden commands and exfiltrate developer secrets; Google fixed it in 0.1.14.
• ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt injection is really an authorization problem disguised as a language problem. If the model can be manipulated, then any security control that depends on the model staying loyal has already failed at the wrong layer. The decisive question is not how well the prompt resists manipulation, but where the system refuses to act even when manipulation succeeds. That makes cryptographic authorization boundaries the structural control point.

Scope-per-tool authorization is the named concept that changes the risk model. When each tool maps to its own token scope, prompt injection can still influence intent but cannot widen authority. That matters because the common failure is not model compromise alone, but scope escalation through over-broad delegated access. Practitioners should read this as a requirement to separate tool capability from conversational access.

Chain-aware delegation exposes the assumption that a single caller can represent an entire workflow. In multi-hop agent chains, the original subject, the intermediate agent, and the final tool call are not interchangeable. The article's RFC 8693 framing shows why attribution and delegation must remain visible across hops. Security teams should stop assuming that the immediate caller is the only identity that matters.

Human-in-the-loop is not enough when the action is irreversible or high impact. Review can reduce silent execution, but high-risk actions still need dual control because prompt injection can steer the request as easily as the model. The governance lesson is that approval design must be tied to consequence, not to whether the initiating actor is human or machine.

Prompt injection forces identity programmes to treat AI agents as governed executors, not smart interfaces. The article's structural defence is consistent with NHI practice: authority should be narrow, explicit, and independently enforced from the reasoning layer. The implication is that identity teams own the blast radius even when the model team owns the prompt.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Authorisation Guide

What this signals

Prompt-injection defence needs to move from model trust to authorization design. Security teams should assume that retrieval, email, and document workflows will eventually carry malicious instructions, then place the final decision behind resource-level checks that the model cannot influence.

Chain visibility becomes a governance requirement, not just an audit feature. Once agents can delegate across multiple hops, identity programmes need to preserve subject, actor, and scope through the whole chain so accountability does not disappear at the first relay.

Identity blast radius is now the right lens for agent safety. The question is no longer whether an agent can be tricked, but how far that trick can travel before an independent authorization boundary stops it.

For practitioners

• Map tool scopes to individual agent capabilities Give each agent tool a distinct authorization scope so summarization, search, email, deletion, and export are separately constrained. Remove broad tokens that let one compromised reasoning path reach unrelated actions.
• Enforce resource-boundary checks on every consequential call Validate scope at the MCP server or resource server before execution, not inside the prompt. If the token does not carry the exact claim required for the tool, deny the request even when the model asks for it.
• Apply dual control to irreversible actions Require a second authorized approver for mass deletes, external payments, public posts, security policy changes, and large data exports. The approval ceremony must be cryptographic and independent of the agent's reasoning.
• Insert step-up approval at consequential thresholds Use a lighter human approval step for moderate-risk actions such as external emails or customer-record changes. Present the action context in plain language so the reviewer can reject suspicious output before it executes.

Key takeaways

• Prompt injection becomes materially dangerous when the model itself can trigger consequential actions, because the security boundary sits in the wrong place.
• The article's defence model shifts enforcement to scope checks, approval gates, and delegation-aware authorization so compromised reasoning cannot widen authority.
• For IAM, PAM, and NHI teams, the practical task is to govern agent access like any other privileged executor, with explicit scope, review, and audit controls.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Scope-Per-Tool Token: A scope-per-tool token is a credential issued for one specific tool and one specific set of actions. It limits what an agent or application can do by binding permissions to a narrow purpose, reducing blast radius if the token is exposed. In practice, it supports least privilege, auditability, and safer delegation across automated workflows.
• Dual Control: A governance pattern that requires two independent authorised people to approve a sensitive action before it is released. In finance, it reduces the chance that a single compromised identity can move money or alter payment instructions on its own.
• Chain-Aware Delegation: A delegation model that preserves the full identity path across multiple agent or service hops. Each hop carries provenance so downstream systems can judge what the original actor could legitimately delegate and where authority should stop.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.