Topic starter
11/11/2026 6:05 pm
TL;DR: Poisoned retrieval context can redirect an agent with legitimate access into unsafe action, even when the user request is ordinary, according to Origin analysis. That means governance has to shift from judging intent after the fact to validating provenance before action.
Editorial analysis by NHI Mgmt Group, based on content published by Origin: “We regret to inform you the agent did exactly what you asked”.
Key questions
Q: Why can a confused deputy in an AI agent cause unsafe action?
A: A confused deputy happens when an agent with legitimate permissions is induced to use those permissions on the wrong task or for the wrong requester.
Q: How should teams govern retrieval sources used by agents?
A: Teams should classify retrieval sources by trust level, restrict them to approved corpora, and log which documents or feeds were used for each agent run.
Q: How do agent traces help detect poisoned context?
A: Agent traces show the inputs, tool calls, retrieved context, and outputs an agent used during a run, which helps detect poisoned context by exposing unexpected prompt injections, tampered retrievals, and abnormal decision paths.
Practitioner guidance
- Restrict who can write to agent context sources Limit write access to notice feeds, knowledge bases and other retrieval sources that agents can consume, and apply approval controls to high-impact content paths.
- Log retrieval lineage for every agent action Persist the source document, retrieval query, rank position and tool call so investigators can see which evidence influenced a specific decision.
- Quarantine high-impact records before they reach the agent Insert moderation or policy checks for notices that can change operational actions, especially where a single record can redirect a shipment or payment.
Bottom line: Agentic confused deputy attacks succeed when malicious context can steer a legitimate delegated action without breaking access control.
Glossary terms: Confused Deputy, Prompt Injection (Agentic), Context Poisoning, Retrieval-augmented Generation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Agentic confused deputy is a trust-boundary failure, not a model-quality failure. The problem is that an agent can act correctly on the wrong evidence while appearing to remain compliant with the user's request. That makes the governance question about what was allowed to influence the action, not whether the final text or tool call looks plausible. Practitioners should treat provenance as a first-class control objective.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern retrieval sources used by agents?
A: Teams should classify retrieval sources by trust level, restrict them to approved corpora, and log which documents or feeds were used for each agent run. Access controls, content validation, and source provenance checks reduce the risk of prompt injection, stale data, or unauthorised documents being retrieved into the agent’s context. retrieval sources
👉 Read our full editorial: Provenance over intent in agentic confused deputy attacks