CAPMAS: Capability-Based Delegation of Privileges in Multi-Agent Systems

• URL: http://arxiv.org/abs/2609.06500v1
• Date: Sun, 06 Sep 2026 09:31:59 GMT
• Title: CAPMAS: Capability-Based Delegation of Privileges in Multi-Agent Systems
• Abstract summary: We present CAPMAS, a novel architecture for secure end-to-end query execution in multi-agent systems.<n>By decoupling authentication and delegation enforcement from agent reasoning, CAPMAS enables practical agentic execution while enforcing strict least-privilege guarantees.
• Score: 10.23324528999764
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Agentic systems require secure and efficient delegation of privileges across multiple collaborating agents. Existing approaches fall into two categories. Some propagate user identities directly to agents, obscuring accountability and creating persistent over-privilege risks that are amplified by the non-deterministic behaviour of AI agents. Others rely on continuous synchronization with a central Identity and Access Management (IAM) provider, introducing additional latency and communication overhead. We present CAPMAS, a novel architecture for secure end-to-end query execution in multi-agent systems. CAPMAS newly combines a contrastive learning-based semantic scoping pipeline that maps natural-language queries to bounded privilege sets before execution with expressive Macaroon-based tokens that enable offline, tamper-evident delegation with monotonic privilege reduction across agents. By decoupling authentication and delegation enforcement from agent reasoning, CAPMAS enables practical agentic execution while enforcing strict least-privilege guarantees. By eliminating synchronous delegation exchanges with the IAM, CAPMAS yields 30 times faster delegation operations, 2 times less delegation-oriented latency and up to 3 times lower bandwidth usage than the OAuth 2.0 Token Exchange (RFC 8693). Its semantic scoping pipeline achieves over 90% perfect privilege-bundle retrieval within 17 milliseconds on enterprise-scale API schemas containing over 3,100 endpoints, while reducing unnecessary privileges by 99.5% when compared to systems that propagate all the user's privileges to agents.

Related papers

• Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems [0.0]
  We present a threat model for multi-agent delegation centered on four adversaries.<n>We show a default runtime modeling common practice fails all four threats.<n>We implement and adversarially evaluate an authorization broker that closes the gap.
  arXiv  Detail & Related papers  (2026-08-31T19:09:34Z)
• A Self-Triggered Agentic Push Recommendation System [77.13502692161426]
  Push notification is a critical recommendation scenario on large-scale platforms.<n>We propose a proactive, Self-Triggered End-to-end Agentic Push Recommendation System.<n>STEPS is already fully deployed at Douyin with over 1 billion users.
  arXiv  Detail & Related papers  (2026-08-03T09:20:53Z)
• How Agents Ask for Permission: User Permissions for AI Agents, from Interfaces to Enforcement [55.966820779528376]
  As AI agents gain prevalence, users are increasingly exposed to the risks such systems entail.<n> Prompt injection attacks, as well as hallucination, can cause agents to leak private information to third parties.<n>As autonomous systems, agents present the more active danger of performing sensitive tasks, such as bank transactions, without the user's intent or authorization.
  arXiv  Detail & Related papers  (2026-07-15T11:36:22Z)
• Token-Flow Firewall: Semantic Runtime Auditing for Persistent AI Agents [76.4694046738862]
  TokenWall is a runtime defense framework that acts as a semantic firewall over agent token flows.<n>We show that TokenWall reduces attack success rate to 12.5% while maintaining a 97.4% benign executable pass rate without human confirmation.
  arXiv  Detail & Related papers  (2026-07-09T12:18:40Z)
• CHI-Bench: Can AI Agents Automate End-to-End, Long-Horizon, Policy-Rich Healthcare Workflows? [150.84850629123287]
  End-to-end automation of realistic healthcare operations stresses three capabilities underrepresented in current benchmarks.<n>$$-Bench is a benchmark of long-horizon healthcare across three domains: provider prior authorization, payer utilization management, and care management.<n>Across 30 agent harness/models configurations, the best agent resolves only 28.0% of tasks, no agent clears 20% on strict pass3, and executing all tasks in a single session slumps the performance to 3.8%.
  arXiv  Detail & Related papers  (2026-05-15T22:34:31Z)
• HDP: A Lightweight Cryptographic Protocol for Human Delegation Provenance in Agentic AI Systems [0.0]
  Agentic AI systems increasingly execute consequential actions on behalf of human principals.<n>No existing standard addresses a fundamental accountability gap.<n>This paper presents the Human Delegation Provenance (HDP) protocol.
  arXiv  Detail & Related papers  (2026-04-06T08:35:27Z)
• AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A [0.0]
  Invocation-Bound Capability Tokens (IBCTs) fuse identity, authorization, and provenance binding into a single append-only token chain.<n>We provide reference implementations in Python and Rust with full cross-language interoperability.
  arXiv  Detail & Related papers  (2026-03-25T19:45:37Z)
• AgentIF-OneDay: A Task-level Instruction-Following Benchmark for General AI Agents in Daily Scenarios [49.90735676070039]
  The capacity of AI agents to effectively handle tasks of increasing duration and complexity continues to grow.<n>We argue that current evaluations prioritize increasing task difficulty without sufficiently addressing the diversity of agentic tasks.<n>We propose AgentIF-OneDay, aimed at determining whether general users can utilize natural language instructions and AI agents to complete a diverse array of daily tasks.
  arXiv  Detail & Related papers  (2026-01-28T13:49:18Z)
• Taming Various Privilege Escalation in LLM-Based Agent Systems: A Mandatory Access Control Framework [16.14469140816631]
  Large Language Model (LLM)-based agent systems are increasingly deployed for complex real-world tasks.<n>This paper aims to understand and mitigate such attacks through the lens of privilege escalation.<n>We propose SEAgent, a mandatory access control framework built upon attribute-based access control (ABAC)<n>Our evaluations show that SEAgent effectively blocks various privilege escalation while maintaining a low false positive rate and negligible system overhead.
  arXiv  Detail & Related papers  (2026-01-17T03:22:56Z)
• Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents [0.6747475365990533]
  In agentic settings reasoning, prompt injection, or multi-agent orchestration can silently expand privileges.<n>We introduce Agentic JWT (A-JWT), a dual-faceted intent token that binds each agent's action to verifiable user intent.<n>A-JWT carries an agent's identity as a one-way hash derived from its prompt, tools and configuration.
  arXiv  Detail & Related papers  (2025-09-16T23:43:24Z)
• Internet of Agents: Weaving a Web of Heterogeneous Agents for Collaborative Intelligence [79.5316642687565]
  Existing multi-agent frameworks often struggle with integrating diverse capable third-party agents. We propose the Internet of Agents (IoA), a novel framework that addresses these limitations. IoA introduces an agent integration protocol, an instant-messaging-like architecture design, and dynamic mechanisms for agent teaming and conversation flow control.
  arXiv  Detail & Related papers  (2024-07-09T17:33:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.