DEV Community

Cover image for Beyond Prompt Injection: The Non-Human Authorization Gap in Enterprise AI
Google Developer Experts profile image Jitendra Gupta
Jitendra Gupta for Google Developer Experts

Posted on

Beyond Prompt Injection: The Non-Human Authorization Gap in Enterprise AI

#ai #security #devops #architecture

The Hidden Vulnerability in Multi-Agent Chains

The biggest architectural risk in enterprise AI today isn’t prompt injection—it’s Delegation Escalation.

When a human user triggers an AI Agent Orchestrator, which then delegates tasks to sub-agents and tool execution gateways via MCP or internal APIs, traditional static service accounts break down.

If you pass broad bearer tokens or static user API keys down the execution chain, you create a massive Confused Deputy vulnerability.

To deploy autonomous multi-agent chains safely at enterprise scale, platform architects must enforce OAuth 2.1 RFC 8693 Token Exchange with explicit actor claims.

The Non-Human Authorization (NHA) Flow

  • Human User Authorization: A user authenticates and grants a specific, bounded scope (e.g., read:finance) to the primary Agent Orchestrator.
  • Token Exchange: The Orchestrator leverages OAuth 2.1 Token Exchange (RFC 8693) via the enterprise identity gateway rather than passing raw user credentials downstream.
  • Actor-Claim Scoped Call: The sub-agent or tool execution layer receives a short-lived token containing a nested actor claim (act) identifying both the human subject and the orchestrator, ensuring execution authority is strictly bounded by the intersection of their permissions.

3 Non-Negotiable Rules for Agentic Identity Governance

  1. Delegation Over Impersonation (RFC 8693): Never allow an agent to blindly impersonate a user. Enforce OAuth 2.1 Token Exchange so every issued JWT token contains a nested actor claim: Human Subject -> Agent Orchestrator -> Sub-Agent. Every downstream API must verify both who authorized the action and which agent executed it.

  2. Intersection of Privileges (User ∩ Agent): An agent’s runtime authority must be the strict mathematical intersection of the user’s IAM permissions and the agent’s registered tool scope. An agent should never acquire more system access than the human user who invoked it.

  3. Ephemeral Tokens & DPoP Binding: Eliminate static configuration API keys and long-lived refresh tokens. Issue short-lived tokens (5-minute TTL) cryptographically bound via DPoP (RFC 9449) or mTLS so intercepted tokens cannot be replayed across service boundaries.

Architect’s Take

Stop treating AI agents as traditional service accounts or background jobs. Non-human identities outnumber human users 17-to-1 in modern cloud environments. If your Identity Provider (IdP) cannot audit nested delegation chains at runtime, your agentic architecture is an unmonitored security breach waiting to happen.

How is your platform team handling OAuth token delegation and non-human identity in your multi-agent workflows?

Sources & References

About Me

I'm an Enterprise Cloud & AI Architect with 14 years of experience in the IT industry, helping organizations design and scale enterprise-grade cloud, AI, and automation solutions.

My current work focuses on building enterprise-scale AIOps platforms, accelerating customers' AI-first transformation journeys, driving FinOps adoption, and developing production-ready Generative AI applications that create measurable business impact.

Feel free to connect with me on LinkedIn or X (Twitter) @jitu028. For 1:1 architecture guidance, visit my Topmate.

Top comments (0)