Provenance over intent in agentic confused deputy attacks

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Origin's research: Agentic confused deputy attacks let poisoned retrieval context redirect legitimate actions, showing that provenance matters more than intent alone.

Why it matters: This matters because practitioners need controls that verify what influenced an agent before it acts, not just whether the output seems to match the request.

Context

Agentic systems fail when retrieval, instruction and evidence all flow through the same context without a reliable trust boundary. In that design, malicious data can steer a legitimate action without ever breaking authentication or permissions, which makes the problem a governance issue as much as a model-safety issue.

The confused deputy pattern is old, but agents make it easier to trigger because they can execute delegated work across documents, tools and memory in one workflow. The practical problem is not whether an agent can reason, but whether the system can prove which input deserved to influence the decision.

Key questions

Q: How do agent traces help detect poisoned context?

A: Agent traces show the inputs, tool calls, retrieved context, and outputs an agent used during a run, which helps detect poisoned context by exposing unexpected prompt injections, tampered retrievals, and abnormal decision paths. Teams can correlate trace events with source provenance, policy checks, and denied tool calls to spot where untrusted content influenced the agent’s actions.

Q: Why can a confused deputy in an AI agent cause unsafe action?

A: A confused deputy happens when an agent with legitimate permissions is induced to use those permissions on the wrong task or for the wrong requester. That can lead to unsafe action because the agent may pass a valid token, invoke a sensitive tool, or approve a change without correctly binding the action to the intended human and scope.

Q: How should teams govern retrieval sources used by agents?

A: Teams should classify retrieval sources by trust level, restrict them to approved corpora, and log which documents or feeds were used for each agent run. Access controls, content validation, and source provenance checks reduce the risk of prompt injection, stale data, or unauthorised documents being retrieved into the agent’s context. retrieval sources

Technical breakdown

How poisoned retrieval becomes delegated action

Retrieval-augmented agents often select the most relevant context items before generating a response or calling a tool. If an attacker can seed that retrieval corpus, a malicious record can outrank legitimate material through repetition, query echoing or recency bias. The model then treats injected content as ordinary evidence because the same context channel carries both user instructions and retrieved data. That is why the security problem is not just prompt injection. It is context integrity, where the input layer can quietly alter the action layer.

Practical implication: Treat retrieval sources as privileged inputs and restrict who can alter the corpora that feed agent decisions.

Why intent checks fail without provenance

Intent screening compares the user's request with the agent's action and asks whether the latter follows from the former. That helps with obvious misuse, but it cannot tell whether the evidence driving the action was legitimate. Provenance adds the missing chain of custody by linking a response to the record, retrieval path and historical state that shaped it. In practice, that means an agent can appear faithful to a request while still acting on contaminated evidence. The gap is structural, not merely a tuning problem.

Practical implication: Record source lineage for retrieved items so reviewers can separate valid delegation from malicious steering.

Trace evidence is the new control surface

A useful agent trace spans the user request, the retrieved context, tool calls and the side effects those calls create. That gives defenders a before-and-after view similar to endpoint telemetry, but with an extra layer: the evidence that was admitted into the decision. When the same request suddenly produces a different action after a new record appears, the trace exposes the influence path. This is why trace data is not just observability. It is the material needed to decide whether an agent acted within policy or was steered off course. Read AI agent registry.

Practical implication: Correlate request, retrieval and tool telemetry so suspicious changes in action can be investigated from evidence, not guesswork.

Threat narrative

Attacker objective: The attacker wants to convert legitimate delegated access into harmful operational action by steering the agent with poisoned context.

1. Entry occurs when an attacker gains write access to the notice or retrieval feed that the agent reads as context.
2. Credential access is not required because the attacker exploits trusted content channels instead of stealing a login or token.
3. Escalation happens when the poisoned record shapes the agent's tool choice or action path while the agent still operates under legitimate delegated authority.
4. Impact is the misuse of that authority to move inventory, redirect shipments or trigger other harmful actions the user never intended.

NHI Mgmt Group analysis

Agentic confused deputy is a trust-boundary failure, not a model-quality failure. The problem is that an agent can act correctly on the wrong evidence while appearing to remain compliant with the user's request. That makes the governance question about what was allowed to influence the action, not whether the final text or tool call looks plausible. Practitioners should treat provenance as a first-class control objective.

Context poisoning creates an NHI governance problem because retrieval sources behave like privileged inputs. When a document, notice feed or MCP-connected source can alter an agent's action, that source has effectively joined the trust boundary and needs shadow AI and AI agent discovery-style oversight. The security failure is uncontrolled influence, not merely untrusted content. Practitioners should inventory and govern every path that can feed an agent's decision.

Action traces matter because they let defenders separate legitimate delegation from malicious steering. A request, retrieved record and downstream tool call form an evidentiary chain that can show when a familiar task suddenly changes shape. That is more valuable than post-hoc intent debates because it exposes the moment influence entered the workflow. Practitioners should build review processes around trace lineage, not only output inspection.

Provenance-aware governance is becoming the deciding control for agentic systems. As agents move deeper into operational workflows, the core question is no longer whether they can follow instructions, but whether the system can prove which data earned the right to shape the action. That shifts the field toward evidence-based authorization for agents. Practitioners should align policy, trace and retrieval controls before agents are allowed to act on business operations.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: AI agent registry

What this signals

Provenance-first control: agent programmes will need to treat source lineage as a security signal, not just a governance nice-to-have. The next maturity step is to make retrieval paths auditable enough that a suspicious action can be traced back to the exact record that influenced it.

As agents move from chat to operations, the main risk shifts from bad answers to bad actions. That means security teams should prepare to validate context sources, not just model outputs, and to investigate influence paths when behaviour changes unexpectedly.

For practitioners

• Restrict who can write to agent context sources Limit write access to notice feeds, knowledge bases and other retrieval sources that agents can consume, and apply approval controls to high-impact content paths.
• Log retrieval lineage for every agent action Persist the source document, retrieval query, rank position and tool call so investigators can see which evidence influenced a specific decision.
• Quarantine high-impact records before they reach the agent Insert moderation or policy checks for notices that can change operational actions, especially where a single record can redirect a shipment or payment.
• Review agent traces for sudden action drift Compare repeated requests against historical actions and flag cases where a new record appears immediately before the workflow changes direction.

Key takeaways

• Agentic confused deputy attacks succeed when malicious context can steer a legitimate delegated action without breaking access control.
• The critical evidence is the provenance chain from source record to retrieval path to tool call, not the final response alone.
• Governance for agent systems has to move upstream to context sources, because output-only review cannot reliably separate intent from influence.

Related NHI Mgmt Group resources: Shadow AI and AI Agent Discovery Guide · Ownership for Orphaned and Abandoned AI Agents · AI agent registry · NHI breach prevention 30 and 90 day plan template

Key terms

• Confused Deputy: A confused deputy is a privileged system that is tricked into performing an action on behalf of an untrusted requester. In agentic AI, the agent may misread malicious input as legitimate intent and then use its own authority to act, which turns a logic problem into a security incident.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Context Poisoning: Context poisoning is the manipulation of information that an AI agent reads before acting. The malicious content does not need to be code. If it changes the agent’s instructions, tool choices, or assumptions, it can alter behaviour and expand the impact of a compromised delivery path.
• Retrieval-augmented Generation: Retrieval-augmented generation is a pattern where an AI model pulls external information before generating output. The security challenge is that access rules can weaken when data is chunked, embedded, cached, or reused, so source permissions may not automatically follow the content into the model's context.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance and agentic AI identity. It helps practitioners connect delegated access, traceability and lifecycle controls to real operational risk.