Systems need a minimal, verifiable authority envelope that travels with purpose while credentials remain audience-bound.
Why this question matters
A secure tool call needs two kinds of evidence: permission to access the resource and provenance explaining why the action belongs to the current task. Passing the original token downstream collapses audiences and creates a confused deputy. Passing the entire conversation creates privacy and injection risk.
A better design derives a narrow credential for the destination and attaches structured claims such as principal, task, purpose, approval state, and policy version. The destination can enforce local rules while investigators retain a link to the broader chain.
Signals worth observing
- A downstream system receives authority without task or principal context.
- Raw prompts are copied between services as authorization evidence.
- One bearer token appears at multiple resource audiences.
Practical control direction
- Exchange credentials rather than passing tokens through.
- Attach signed, minimal purpose and delegation references.
- Store sensitive narrative context behind access-controlled evidence IDs.
AgentCollusion lensCollusion investigations need to join local enforcement decisions without creating a central store of every private prompt.
