Every credential and action must be bound to a specific resource, tenant, principal, and task context.
Why this question matters
The confused-deputy problem appears when a more privileged component cannot distinguish on whose behalf it is acting. MCP forbids token passthrough and requires audience validation; RFC 8707 recommends resource identifiers specific enough to separate tenants where necessary.
Agent memory makes this harder because context can survive across requests. A tenant identifier in the transport is not enough if retrieved memory, cached tools, or delegated tasks still carry another tenant’s data or authority.
Signals worth observing
- A token audience is shared across tenant-specific resource paths.
- Memory or artifacts cross tenant boundaries within one agent session.
- A downstream tool cannot reconstruct the initiating tenant.
Practical control direction
- Use tenant-specific resource identifiers and policy checks.
- Partition memory, task state, and tool credentials by principal.
- Reject downstream calls with incomplete delegation context.
AgentCollusion lensCross-tenant anomalies may look like collusion even when the root cause is authority confusion, so detectors need both hypotheses.Sources and further reading
- Model Context Protocol authorization specification
- IETF RFC 8707: Resource Indicators for OAuth 2.0
- OWASP: Agentic AI threats and mitigations
Next field note: Authority Provenance Must Survive Tool Calls
