Confused Deputy Problem
The confused deputy problem is a security failure in which a privileged program is manipulated into exercising its authority on behalf of a caller who lacks that authority, without any credential being stolen.
A Fifty-Year-Old Problem With a New Deputy
Norm Hardy named the pattern in 1988, describing a compiler with write access to a billing file that callers could trick into overwriting it. The deputy holds legitimate authority and uses it on instruction from someone who should not have reached it. Nothing is stolen and no boundary is broken, since the deputy was always allowed to do the thing it did.
AI Agents Are Deputies by Construction
An agent acts on behalf of a user while holding credentials of its own, which is the exact shape of the problem. It accepts instructions in natural language from sources of varying trust, with no reliable separation between an instruction from its principal and text encountered in a document it was asked to summarize. An agent holding broad access becomes a route to that access for anyone who can place words in its context, which compounds whatever excessive agency it already carries.
Delegation Chains Widen the Exposure
A single agent is one deputy. An agent that calls other agents creates a chain where the authority exercised at the end bears no relation to the authority of whoever started the request, a condition described under multi-agent system design. Each hand-off drops context about who asked and why, so the final tool call carries no trace of the original caller's rights.
Identity Has to Travel With the Request
The durable control passes the calling identity through every hop and evaluates authorization at the point of action against that identity, instead of against the agent's own service account. Agent permissions and scoping covers the mechanics, and treating untrusted content as data that can never carry authority closes the other half, which indirect prompt injection describes.
Related Terms
Full AI Visibility. Full Control. One Connected Platform.
Enterprise AI is expanding faster than most governance programs can track. Kovrr connects every AI signal across browser, endpoint, network, identity, and vendor systems into a single platform so security, governance, and risk teams work from the same evidence.
