A failure mode where an AI agent uses its own authority to satisfy one tool's request by invoking another tool that holds higher-value data or privileges. The agent is not malicious, but it misapplies delegated authority across systems that should have remained isolated.
How Agentic Confused Deputy Happens
Agentic confused deputy is a delegation failure, not a malicious act. The agent receives one request, then uses its own authority to satisfy it by reaching into another tool, account, or data boundary that was never meant to be exposed through that request path.
This usually appears when tool permissions are broader than the task, when the agent can chain actions across systems without a fresh policy check, or when an upstream request is treated as proof that downstream access is safe. In practice, the core failure is authority confusion: the agent becomes the path by which a lower-trust request borrows higher-trust capability.
Why It Matters in Agentic Systems
The danger is that the agent can make an unprivileged or loosely scoped request look legitimate while still reaching sensitive resources. That can expose data, trigger actions, or reuse tokens and sessions in ways the original caller should never have been able to influence.
Because the agent is acting within its own runtime authority, the compromise is often not visible as an obvious policy breach at the first hop. The misuse happens across tool boundaries, where one system assumes the request was already trusted because another system or the agent itself initiated it.
Common Failure Patterns
Confused deputy behaviour often shows up as token passthrough, broad tool forwarding, or one tool being allowed to act as an implicit proxy for another. The agent may also inherit a user context, then apply it to a different tool with a different trust model, turning a narrow permission into a much wider reach.
Another common pattern is insufficient separation between intent, authorization, and execution. If the agent can decide what to do, invoke tools, and reuse the same authority across steps without per-action checks, a benign request can expand into an unintended privilege path.
Isolation and Control Boundaries
Defending against this failure mode means treating every tool boundary as a real security boundary, not just an implementation detail. The most useful mental model is to keep request intent, delegated authority, and resource access tightly bound so the agent cannot substitute one for the other.
That is why guidance for AI Agent Authorisation Guide emphasizes task-scoped access, per-action decisions, and human approval where needed. It also aligns with the practical containment model in the MCP Security Guide, where authorization and token handling must prevent an agent from forwarding trust farther than intended.
For deeper identity and delegation design, the Agentic AI Identity Guide explains how agent identities, delegation, and retirement should be modeled so authority is explicit rather than accidental. When teams are evaluating a broader control posture, the Zero Trust for AI Agents guide is a useful companion because it frames each request as something to verify, not something to trust by default.
Risk and Threat Considerations
Confused deputy conditions create a direct privilege-escalation path, even when the agent itself is behaving as designed. The risk is highest where the agent can act across multiple systems, reuse tokens or sessions, or reach privileged data after a request originated in a less trusted context.
Failure mechanism: A lower-trust request causes the agent to invoke a higher-trust tool or resource without enforcing a fresh authorization decision at the new boundary.
Impact: Sensitive data exposure, unauthorized actions, lateral access across tools, and privilege amplification through delegated authority are all possible outcomes.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Agentic confused deputy is a privilege boundary failure across tools. |
| ASI02 — Tool Misuse | The agent misuses one tool to satisfy another tool's request path. | |
| ASI09 — Human-Agent Trust Exploitation | The failure exploits trust placed in the agent's delegated authority. | |
| Recommendation — Bind each tool call to a fresh authorization decision and block privilege reuse across boundaries. Constrain tool invocation paths so the agent cannot route requests through unintended tools. Insert human approval for high-impact cross-boundary actions and sensitive tool chains. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Confused deputy risk grows when agent authority exceeds task needs. |
| IA-2 — Identification and Authentication (Organizational Users) | Strong identity binding helps keep request origin distinct from agent authority. | |
| AU-2 — Event Logging | Audit trails are needed to trace agent-driven cross-tool authority use. | |
| Recommendation — Minimize each agent's permissions to the smallest task-scoped set. Authenticate the principal behind each request before allowing privileged agent actions. Log agent decisions and downstream tool invocations with enough context to reconstruct delegation. | ||
| NIST Zero Trust (SP 800-207) | 3.4 — Policy Enforcement Point | Zero trust requires enforcement at each access decision, not only at entry. |
| Recommendation — Enforce authorization at every tool boundary instead of inheriting earlier trust. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Agent authority reused across tools becomes overprivilege in practice. |
| NHI-10 — Human Use of NHI | Confused deputy can occur when human context is reused by the agent across systems. | |
| Recommendation — Reduce standing permissions on agent credentials and separate privileged tool access. Prevent human context from being replayed into unrelated downstream tool actions. | ||
| OWASP API Security Top 10 | API5 — Broken Function Level Authorization | Tool chaining can bypass function-level boundaries between requests. |
| Recommendation — Verify function-level authorization before each cross-tool operation. | ||
Practitioner Guidance
Governance implication: Treat each agent tool chain as a policy object with its own scope, ownership, and approval model. If one tool can reach another on behalf of the same request, the design should make that delegation explicit, bounded, and auditable rather than implicit.
What to watch for: Review any flow where the agent can forward user intent into a different privilege domain, especially when the downstream tool has broader data access than the upstream request justified. The most dangerous cases are the ones that look operationally convenient because they remove a visible approval step.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org