APC Framework Closes Authorization Gaps in Multi-Agent LLM Systems

LLM-based agents receive static permissions at session start, and each request is evaluated independently without regard to prior actions. This lets an agent act contrary to its assigned task, combine individually permitted actions into a prohibited outcome, or delegate unrestricted authority to a sub-agent. Prompt injection is only dangerous because the agent already holds that authority, making this fundamentally a problem of authorization architecture, not model behavior.

The proposed Agentic Principal Chain (APC) tracks delegated authority as it passes from one principal to the next, evaluating each request against six authorization checks based on accumulated session state, while carrying forward restricted scope and budgets. Using 'composition closure,' APC blocks forbidden combinations of otherwise-permitted actions and enforces decisions outside the model itself. The authors formally prove blast radius monotonicity and, under defined conditions, composition soundness for APC implementations.

Across 3,154 test cases drawn from InjecAgent, AgentDojo, and ASB benchmarks—including a compromised-model test that inserts a real attack call after the first legitimate action—AgentDojo exfiltration success fell from 75-100% to 0% across all four domains, and all 544 InjecAgent data-theft attempts were blocked. Destructive actions dropped from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization added just 0.24 ms of latency at the 99th percentile, though task utility fell by 8.6-13.9 percentage points in guarded settings.