Authorization Propagation in Multi-Agent AI Systems: Identity Governance as Infrastructure

• URL: http://arxiv.org/abs/2605.05440v1
• Date: Wed, 06 May 2026 20:56:17 GMT
• Title: Authorization Propagation in Multi-Agent AI Systems: Identity Governance as Infrastructure
• Abstract summary: We call this problem authorization propagation.<n>It is not reducible to prompt injection and is not fully addressed by classical access-control models such as RBAC, ABAC, or ReBAC.<n>The paper formalizes authorization propagation as a workflow-level property, identifies three sub-problems, and derives seven structural requirements for authorization architectures in multi-agent AI systems.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The security discussion around agentic AI focuses heavily on prompt injection. This paper argues that multi-agent systems also create a distinct authorization problem: maintaining authorization invariants as non-human principals retrieve data, delegate tasks, and synthesize results across changing boundaries. We call this problem authorization propagation. It is not reducible to prompt injection and is not fully addressed by classical access-control models such as RBAC, ABAC, or ReBAC. The paper formalizes authorization propagation as a workflow-level property, identifies three sub-problems (transitive delegation, aggregation inference, and temporal validity), and derives seven structural requirements for authorization architectures in multi-agent AI systems. Recent work on invocation-bound capability tokens, task-scoped authorization envelopes, dependency-graph policy enforcement, and execution-count revocation demonstrates that the field is converging on the problem, but not yet on a complete architecture. The central claim is that identity governance must be treated as infrastructure: evaluated continuously, enforced at every interaction boundary, and designed into the system before orchestration logic is allowed to scale. Preliminary implementation evidence from a production enterprise AI platform shows that ordinary system behavior, not only adversarial action, already produces the failures this model predicts.

Related papers

• Authorization Architectures for Tool-Using AI Agents [0.0]
  Trustworthy human-AI systems require that every consequential agent action be traceable to a human principal.<n>This review introduces a principal hierarchy spanning human user, operator/deployer, orchestrator agent, sub-agent, and tool endpoint as an organizing framework.<n>We propose seven structural requirements, derive a four-layer reference architecture, apply the requirements to three deployable reference configurations, and identify runtime enforcement and aggregation bounds as the principal unresolved gaps.
  arXiv  Detail & Related papers  (2026-09-14T17:21:22Z)
• Formal Verification of Agentic Systems over Operational Data [59.98246281888422]
  Agentic systems driven by large language models (LLMs) are increasingly deployed in real-world where they act on persistent operational data.<n>Existing approaches do not provide such system-level guarantees.<n>We study here the verification of agentic systems comprising a single LLM and a tool orchestration harness over relational operational data.
  arXiv  Detail & Related papers  (2026-08-04T13:01:30Z)
• DocOps: A Verifiable Benchmark for Autonomous Agents in Complex Document Operations [106.74348504930124]
  We introduce DocOps, a deterministically verifiable evaluation framework underpinned by a hierarchical taxonomy.<n>Based on DocOps, we systematically evaluate representative closed- and open-source models across various agentic harnesses.<n>Our work exposes the capability boundaries of agents in maintaining global document consistency, shedding light on the future design of robust, non-destructive agents.
  arXiv  Detail & Related papers  (2026-07-22T07:52:59Z)
• Specifying AI-SDLC Processes: A Protocol Language for Human-Agent Boundaries [0.0]
  We propose a domain-specific language for specifying AI-SDLC processes as protocols.<n>The language distinguishes policy (declared intent) from mechanism (structural enforcement)<n>A working implementation demonstrates feasibility; empirical evaluation is future work.
  arXiv  Detail & Related papers  (2026-05-24T02:52:47Z)
• Verifiable Agentic Infrastructure: Proof-Derived Authorization for Sovereign AI Systems [2.124730017640531]
  We introduce a verification framework for governed mutation systems that computes execution authority from structured artifacts.<n>DTF provides an infrastructure foundation for making agentic execution governable, auditable, and bounded in sovereign AI deployments.
  arXiv  Detail & Related papers  (2026-05-13T17:58:52Z)
• Digital Identity for Agentic Systems: Toward a Portable Authorization Standard for Autonomous Agents [0.0]
  This paper analyzes representative enterprise use cases in insurance claims processing and supply chain integrity.<n>It proposes a portable authorization model for autonomous agents based on issuer-authored authorization payloads.
  arXiv  Detail & Related papers  (2026-05-12T04:04:34Z)
• Securing the Agent: Vendor-Neutral, Multitenant Enterprise Retrieval and Tool Use [0.0]
  We introduce a layered isolation architecture combining policy-aware ingestion, retrieval-time gating, and shared inference.<n>This approach centralizes security-critical operations--tool execution authorization, state isolation, and policy enforcement--on the server.<n>We evaluate it empirically and show that ABAC gating eliminates cross-tenant leakage while introducing negligible overhead.
  arXiv  Detail & Related papers  (2026-05-06T17:59:21Z)
• IMPACT-CYCLE: A Contract-Based Multi-Agent System for Claim-Level Supervisory Correction of Long-Video Semantic Memory [73.22944697933603]
  Existing pipelines produce opaque, end-to-end outputs that expose no intermediate state for inspection.<n>We present IMPACT-Cycle, a supervisory multi-agent system that reformulates long-video understanding as a multimodal iterative claim-level maintenance.
  arXiv  Detail & Related papers  (2026-04-22T03:03:33Z)
• Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks [46.32011684548212]
  AI agents are vulnerable to indirect prompt injection, in which malicious instructions embedded in untrusted data can trigger dangerous agent actions.<n>This position paper discusses our vision for system-level defenses against indirect prompt injection attacks.
  arXiv  Detail & Related papers  (2026-03-31T17:15:46Z)
• Chain-of-Authorization: Internalizing Authorization into Large Language Models via Reasoning Trajectories [21.063230721511726]
  Chain-of-Authorization (CoA) framework internalizes authorization logic into Large Language Models' core capabilities.<n>CoA integrates policy execution with task responses, making authorization a causal prerequisite for substantive responses.
  arXiv  Detail & Related papers  (2026-03-24T07:13:01Z)
• Reasoning Provenance for Autonomous AI Agents: Structured Behavioral Analytics Beyond State Checkpoints and Execution Traces [0.0]
  Agent Execution Record (AER) is a structured reasoning primitive that captures intent, observation, and inference as first-class queryable fields on every step.<n>We show how AERs enable population-level behavioral analytics: reasoning pattern mining, confidence calibration, cross-agent comparison, counterfactual regression testing via mock replay.
  arXiv  Detail & Related papers  (2026-03-23T08:27:54Z)
• Cryptographic Runtime Governance for Autonomous AI Systems: The Aegis Architecture for Verifiable Policy Enforcement [0.0]
  This paper presents Aegis, a runtime governance architecture for autonomous AI systems.<n>Aegis treats policy and legal constraints as execution conditions rather than advisory principles.
  arXiv  Detail & Related papers  (2026-03-15T04:04:57Z)
• Beyond the 'Diff': Addressing Agentic Entropy in Agentic Software Development [42.371764229953165]
  We propose a process-oriented explainability framework that exposes how agentic decisions unfold across time, tool calls, and architectural boundaries.<n>Our approach provides intent-level telemetry that complements, rather than replaces, existing review practices.<n>By treating cognitive drift as a first-class concern alongside code quality, our framework supports the minimum level of human comprehension required for agentic oversight to remain substantive.
  arXiv  Detail & Related papers  (2026-03-03T12:55:28Z)
• Just Ask: Curious Code Agents Reveal System Prompts in Frontier LLMs [65.6660735371212]
  We present textbftextscJustAsk, a framework that autonomously discovers effective extraction strategies through interaction alone.<n>It formulates extraction as an online exploration problem, using Upper Confidence Bound--based strategy selection and a hierarchical skill space spanning atomic probes and high-level orchestration.<n>Our results expose system prompts as a critical yet largely unprotected attack surface in modern agent systems.
  arXiv  Detail & Related papers  (2026-01-29T03:53:25Z)
• Faramesh: A Protocol-Agnostic Execution Control Plane for Autonomous Agent Systems [0.0]
  Faramesh is a protocol-agnostic execution control plane that enforces execution-time authorization for agent-driven actions.<n>We show how these primitives yield enforceable, predictable governance for autonomous execution.
  arXiv  Detail & Related papers  (2026-01-25T08:27:27Z)
• Binding Agent ID: Unleashing the Power of AI Agents with accountability and credibility [46.323590135279126]
  BAID (Binding Agent ID) is a comprehensive identity infrastructure establishing verifiable user-code binding.<n>We implement and evaluate a complete prototype system, demonstrating the practical feasibility of blockchain-based identity management and zkVM-based authentication protocol.
  arXiv  Detail & Related papers  (2025-12-19T13:01:54Z)
• MA-RAG: Multi-Agent Retrieval-Augmented Generation via Collaborative Chain-of-Thought Reasoning [36.3918410061572]
  MA-RAG addresses the inherent ambiguities and reasoning challenges in complex information-seeking tasks.<n>Unlike conventional RAG methods that rely on end-to-end fine-tuning or isolated component enhancements, MA-RAG orchestrates a collaborative set of specialized AI agents.<n>Our results highlight the effectiveness of collaborative, modular reasoning in retrieval-augmented systems.
  arXiv  Detail & Related papers  (2025-05-26T15:05:18Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.