Notifications
Clear all
Topic starter
18/08/2026 2:49 pm
TL;DR: Multi-agent AI systems can preserve or distort authority across delegation, retrieval, and synthesis in ways request-level controls cannot see, according to TruFoundry’s analysis of the emerging term authorization propagation. The core issue is that RBAC, ABAC, and ReBAC answer who may make a request now, while workflow-level invariants decide whether the whole chain stays within the original authority boundary.
NHIMG editorial — based on content published by TruFoundry: Authorization Propagation, Explained: Why Request-Level Access Control Is Not Enough
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials.
- 96% of technology professionals identify AI agents as a growing security threat, and 66% believe this risk is immediate.
Questions worth separating out
Q: How should security teams govern AI agent authorization in distributed systems?
A: Security teams should govern AI agent authorization as a per-request decision problem, not a one-time entitlement.
Q: Why do traditional RBAC and ABAC controls fall short for AI agents?
A: They usually assume one stable identity making one request at a time.
Q: What breaks when an agent can delegate work to another agent?
A: When one agent delegates to another, the accountability chain becomes part of the security problem.
Practitioner guidance
- Define the workflow as the unit of authorisation Map every mediated agent flow from initial request through delegation, retrieval, and synthesis so policy is evaluated against the whole chain, not a single API call.
- Constrain delegated authority at the gateway boundary Require downstream calls to inherit only the originating principal’s scoped authority, and prevent spawned agents from widening access as they branch into subtasks.
- Shorten token lifetime to match task duration Use short-lived, centrally revocable credentials so a grant can expire while a workflow is still running instead of surviving until session end.
What's in the full article
TruFoundry's full article covers the operational detail this post intentionally leaves for the source:
- The paper-level explanation of transitive delegation, aggregation inference, and temporal validity in multi-agent systems.
- The seven structural requirements the article attributes to architectures that preserve authorization invariants.
- The gateway-level implementation pattern for per-user delegation and task scoping across registered operations.
- The discussion of where chain traces help audit review and where they do not decide authorization by themselves.
👉 Read TruFoundry's analysis of authorization propagation in AI gateways →
Authorization propagation: what IAM teams are missing in AI gateways?
Explore further
18/08/2026 3:31 pm
Authorization propagation is the right term because it names a workflow-level failure, not a request-level one. Enterprises have spent years perfecting policies that answer whether a principal may make a single call, but multi-agent systems now require assurance that authority survives the entire chain without widening. That is a different governance unit, and it belongs to identity architecture rather than application logic. Practitioners should treat the workflow as the security boundary, not the request.
A few things that frame the scale:
- 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when a multi-agent workflow exceeds its authority?
A: Accountability sits with the organisation that defined the operating model and the control plane that enforced it. If delegation, token lifetime, and review logic do not reflect workflow-level behaviour, then the policy design failed, even if each individual request looked valid.
👉 Read our full editorial: Authorization propagation exposes the gap in request-level AI controls
