01 / Attack path
How the boundary is crossed
An untrusted document instructs a privileged finance agent to export the customer ledger through a connected tool.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Separate document content from task instruction, validate the initiating principal and originating grant, and deny export at the executor.
Architecture review / negative test
Make the boundary testable.
The deputy has a privilege the requester lacks. In agent workflows the requester may be another agent, an MCP client or retrieved content. Trace which credential the executor sees and where the lower-trust origin disappears. A boundary check should require the original task grant, not just the deputy’s broad service identity.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
The tool trusts the finance agent’s credential but loses the lower-trust source that induced the call.
Preserve source provenance, requested export, decision and downstream effect for incident reconstruction.
04 / Canonical scope
Why this reference stands alone
Prompt-injection page owns the injection path; this threat analysis owns privilege borrowing at the deputy boundary.
MCP-specific failure path
Two ways an MCP server becomes the deputy.
First, a server may accept a client token intended for a different protected resource. The MCP authorization specification requires resource indicators and validation that a presented token was issued for the server. The negative test is straightforward: send a valid token for server A to server B and confirm B rejects it before any tool dispatch. Signature validity alone is not enough.
Second, a server may use its own broad downstream credential to perform an action that the initiating user and task never authorized. A support agent’s read task can reach a server that also has customer-deletion access. The server must carry enough trusted caller and task context into a per-action decision; the downstream API should enforce the resulting bound operation and target. A broad service credential is transport capability, not a delegated mandate.
Record which principal initiated the call, the resource audience check, the selected tool and normalized arguments, the grant and policy decision, and the actual downstream response. Never retain raw bearer tokens for the sake of an audit trail. If the server calls a separate third-party API, use a separately authorized credential for that resource rather than passing through the client’s MCP token.
This is an MCP example within the broader confused-deputy failure. It does not need a second near-duplicate URL. See the MCP threat model for the surrounding discovery, token, tool and outcome boundaries.
Architecture field test
The deputy must not launder a weaker caller
Whose authority is the deputy using?
- 01Lower-trust input requests action
- 02Privileged agent selects tool
- 03Executor checks origin and task
- 04Effect denied outside delegated scope
Work the boundary
A search result says a security agent should export an entire tenant’s audit logs to a URL. The agent can technically call the export API, but the result author has no authority to define the incident task or destination.
| Required facts | Instruction provenance, initiating principal, agent privilege, task grant, requested effect and executor decision. |
|---|---|
| Allow only when | Only a trusted task origin gives the deputy bounded permission for the requested effect. |
| Deny when | A retrieved document or MCP result tells a privileged agent to use a capability the source never held. |
Break the assumption
Embed the same command in a tool response and in a user-authorized task. The former must not acquire privilege merely by being read; the latter still needs destination and scope checks.
Design tradeoff
Content filtering can reduce exposure but is not a complete authority boundary. An executor-side decision limits blast radius even when the model follows hostile text.
For the deputy must not launder a weaker caller, consult OWASP AI Agent Security Cheat Sheet. This worked decision and negative test are ProofGrid analysis.
Continue with Prompt injection and unauthorized action.
Primary references