Authorization is the layer nobody built
Single-agent permissions are solved. The moment one agent delegates to another, the acting party and the authorised party stop being the same entity, and nothing in the stack knows what to do about it.
Why single-agent solutions do not extend
Give one agent a scoped credential and audit what it does — that works. Multi-agent breaks it immediately. When A delegates to B, whose permissions apply? What survives three more hops? The delegation graph is constructed at runtime by a language model, and no credential system was designed for that.
The failure mode is privilege accumulation. Each hop is individually reasonable and the composition grants something no single step authorised. This is a well-understood class of bug in distributed systems, arriving in a setting where the topology is decided by inference.
The architectural answer
Separate the component that reasons from the component that acts. A system that both decides and executes has no boundary an attacker must cross — convincing it is sufficient. Split them and an injection has to survive a second component never exposed to the poisoned context.
It is the same separation operating systems make between user space and kernel space, for the same reason. Not because the deciding component is untrustworthy, but because a boundary that must be crossed is checkable and a judgement call is not.
The cost, stated plainly
Capability. Every constraint on what the acting component accepts is a constraint on what the system can do, and that is exactly the tradeoff most agent products are currently resolving in the other direction.
Which is why writing the rules into the prompt is so appealing and so insufficient. A guardrail in the context window is a strong suggestion competing with whatever arrives after it. Good against accidents. Not a control.
arXiv — Authorization propagation in multi-agent AI systems: identity governance as infrastructure → · arXiv — Parallax: why AI agents that think must never act → · The Register — Prompt injection isn't the bug, AI agent frameworks are →