Identity governance as infrastructure: the authorization problem in multi-agent systems
New work argues that authorization propagation across multi-agent systems is an infrastructure problem rather than an application one. When agent A delegates to agent B, whose permissions apply, and how does that survive three more hops?
Single-agent permissions are a solved problem: give the agent a scoped credential and audit what it does. Multi-agent breaks that immediately, because the acting party and the authorised party stop being the same entity and the chain between them is constructed at runtime.
The failure mode is privilege accumulation. Each hop is individually reasonable, and the composition grants something no single step authorised. This is a well-understood class of bug in distributed systems, arriving in a setting where the delegation graph is decided by a language model.
Framing it as infrastructure is the correct move. Identity and authorization have never been solvable at the application layer in any previous distributed architecture, and there is no reason this one is different.
arXiv — Authorization propagation in multi-agent AI systems: identity governance as infrastructure → · arXiv — Operational reframing and approval-framed delegation in multi-agent LLM safety → · Unit 42 — Fooling AI agents: web-based indirect prompt injection observed in the wild →