Insecure Agent Delegation

Domain

Agentic architecture

ROOTVIEL support

Verified by ROOTVIEL — A deterministic, LLM-free verifier settles a specific property under stated assumptions — either a structural property over a graph, or an effect reproduced in execution. It does not by itself mean the whole system is secure, nor that an end-to-end exploit was run beyond what the evidence scope states.

Evidence scope

Structural property — Checked over a static authority/dataflow graph — the property holds in the code; no exploit was run.

Analysis family

FAM-GENAI-STATIC

CWE

CWE-668, CWE-799, CWE-834

Insecure agent delegation is the failure to constrain authority as it passes from one agent to another. In a multi-agent system, a parent agent delegates a task to a child agent, which may delegate further. Safe delegation holds four properties: the authority handed down only decreases, the identity handed down is attenuated (the child does not impersonate the parent with full rights), the chain has a bounded depth, and the chain does not cycle. Violating any one of these is insecure delegation.

The failures are structural and independent. Authority that widens rather than narrows lets a child do what the parent could not. An un-attenuated identity lets a child act as the parent. An unbounded depth lets a chain accumulate or amplify effects. A cycle lets a chain spin — re-entering an agent that re-delegates back — producing runaway execution. Each is a property of the delegation graph, checkable without running the agents.

Multi-agent orchestration — planners spawning workers, agents calling sub-agents, tool-agents invoking other tool-agents — is where delegation lives. Any system where an agent can create or hand authority to another agent, especially recursively, is a candidate for these failures.

• ▸A planner that spawns worker agents and passes them its own credentials wholesale.
• ▸Agents that can delegate to agents that can delegate again, with no cap on depth.
• ▸Orchestration graphs where A can call B and B can call A, enabling a cycle.

Model delegation as a directed graph: nodes are agents, edges are "delegates to", and each edge carries the authority and identity handed across it. The four invariants map directly onto graph properties. "Authority must only decrease" is a monotonicity check along every edge. "Identity must be attenuated" is a check that the child’s effective identity is a strict reduction of the parent’s. "Depth must be bounded" is a longest-path check against a maximum (default 3). "Delegation must not cycle" is a cycle-detection check.

Because all four are pure graph checks over a delegation graph, they are deterministic and need no probabilistic judgement. The analysis does not reason about what an agent will say or do; it reasons about whether the structure of who-may-delegate-what-to-whom obeys the invariants. That makes the checks sound with respect to the graph they are given — their completeness is bounded by whether the graph reflects the real delegation topology.

Attenuation

Each delegation hands down a strict subset of authority and a reduced identity — never equal-or-greater.

Delegation depth

The length of the longest delegation chain; bounded by a maximum (default 3).

Delegation cycle

A path in the graph that returns to an agent already in the chain, enabling runaway re-delegation.

The defect is that delegation passes authority and identity without enforcing attenuation, depth, and acyclicity. The convenient default — hand the child whatever the parent has, let it delegate freely — treats delegation as free and reversible when it is neither. There is no structural rule forcing authority to shrink at each hop, capping the chain, or breaking cycles, so the graph is allowed to express power the original grant never intended.

1. 1A parent agent delegates a task to a child and passes authority/identity across the edge.
2. 2Because authority is not forced to decrease, the child receives equal or broader authority than the parent held for that task.
3. 3The child, carrying an un-attenuated identity, acts as if it were the parent — or delegates onward with the same surplus.
4. 4With no depth bound, the chain grows; with no cycle check, it can re-enter an earlier agent and re-delegate.
5. 5The result is a sub-agent (or a looping chain) wielding authority, identity, or execution volume beyond the original grant.

A synthetic, illustrative delegation routine that passes the parent’s full authority and identity down with no attenuation, no depth cap, and no cycle guard:

synthetic — do not use; illustrates the flaw
# UNSAFE: authority/identity passed unchanged; no depth or cycle limits.
def delegate(parent, task):
    child = spawn_agent(
        authority=parent.authority,             # not reduced -> may not decrease
        identity=parent.identity,               # not attenuated -> child acts AS parent
    )
    result = child.run(task)
    for sub in result.subtasks:
        delegate(child, sub)                    # no depth bound, no cycle check
    return result

Enforce the four invariants in the delegation primitive itself: compute a strictly reduced authority and attenuated identity for the child, refuse to exceed the depth bound, and refuse to re-enter an agent already on the chain.

synthetic — invariants enforced at the delegation boundary
# SAFER: attenuate authority + identity; bound depth; forbid cycles.
MAX_DEPTH = 3

def delegate(parent, task, chain):
    if len(chain) >= MAX_DEPTH:
        raise Denied("delegation depth bound exceeded")
    child_authority = reduce_for(parent.authority, task)   # strict subset
    if not is_strict_subset(child_authority, parent.authority):
        raise Denied("authority must only decrease")
    child_identity = attenuate(parent.identity)            # reduced identity
    child = spawn_agent(authority=child_authority, identity=child_identity)
    if child.id in chain:
        raise Denied("delegation must not cycle")
    result = child.run(task)
    for sub in result.subtasks:
        delegate(child, sub, chain + [child.id])
    return result

• ▸Authorization: a sub-agent wields authority broader than the original grant intended (privilege creep down the chain).
• ▸Identity: an un-attenuated child acts as the parent, defeating accountability and scoping.
• ▸Availability: unbounded depth or a cycle produces runaway execution — resource exhaustion, cost blow-ups, infinite loops.
• ▸Containment: a compromised sub-agent with surplus authority has a far larger blast radius than its task warranted.

All four conditions are decidable by pure graph checks over the delegation graph: monotonic-decrease of authority along edges, strict attenuation of identity, longest-path against the depth bound, and cycle detection. A finding is a concrete violating edge or path — an edge where authority does not decrease, a path exceeding the bound, a back-edge forming a cycle. The checks are deterministic; their reach is bounded by whether the supplied graph reflects the real delegation topology.

Support level

Verified — the execution engine runs pure graph checks over the delegation graph.

Family

FAM-GENAI-STATIC — static graph reasoning.

Declared invariants

"delegated authority must only decrease", "delegated identity must be attenuated", "delegation depth must be bounded" (default max 3), and "delegation must not cycle."

The engine evaluates the four invariants as graph properties: authority monotonicity along each delegation edge, identity attenuation across each hop, longest-path depth against the default maximum of 3, and cycle detection. A violation is reported as the specific edge or path that breaks an invariant.

Make the delegation primitive enforce the invariants; do not leave them to convention.

• ▸Preventive: compute a strictly reduced authority and attenuated identity for every child; refuse a delegation that would not decrease authority.
• ▸Preventive (structure): cap delegation depth (default 3) and reject any delegation that would re-enter an agent already on the chain.
• ▸Detective: run the four graph checks over the delegation topology in CI and at runtime; alert on any violating edge or path.
• ▸Corrective: on a detected violation, halt the chain and fail closed; budget per-chain resources so a runaway chain is bounded even if a check is missed.

Verify by constructing synthetic delegation graphs that violate each invariant in turn — a widening-authority edge, an un-attenuated identity, a chain of depth 4, and an A→B→A cycle — and confirming each is flagged and refused, while a conforming graph passes. Re-run the graph checks over the real delegation topology and confirm no violating edge or path remains. Report as "the four delegation invariants hold over the supplied graph".

• ▸Passing the parent’s full authority and identity to a child for convenience.
• ▸Relying on the model to "not delegate too deep" instead of enforcing a hard depth bound.
• ▸Having no cycle check, so two agents can delegate to each other indefinitely.
• ▸Treating attenuation as sufficient without also asking whether the reduced authority is still larger than the task needs.

Insecure delegation is the multi-agent face of the confused deputy — un-attenuated authority is exactly what a confused deputy spends — and it feeds privilege escalation through agents when authority widens down a chain. Bounded depth and acyclicity also connect it to availability failures like runaway recursion.