Society · Protocols
ConfusedDeputy
Guard against privilege confusion by binding authority checks to the upstream caller, not the executing deputy
Definition
Mechanism
An Agent that holds Permission on behalf of one principal is tricked by a less-privileged caller into exercising that authority for the caller's benefit. The classic 1988 Hardy framing: a privileged compiler asked to write debug output to a billing file ends up corrupting the billing file because access was checked against the compiler's identity, not the requesting user's. In LLM systems the same shape appears as prompt injection: an Actor with tool access is induced by adversarial input to invoke its tools on the attacker's behalf, because permission was bound to the agent process, not to the upstream request that motivated each tool call.
Preconditions
- An Agent holds Permission broader than at least one of its callers.
- An untrusted input path can influence which action the agent takes with that permission.
Postconditions
- Either the action is authorized against the caller's identity, or the action is refused.
- An audit trail records both the deputy and the requesting caller, not just the deputy.
Invariants
- Authority must be checked against the upstream requester's identity, not against the running process's identity.
- Forwarded calls must carry, or re-derive, the authority of the original caller — never the deputy's.
Risks
Failure modes
Prompt injection
untrusted input redirects an LLM Agent's tool use toward the attacker's goals.
Capability leak
a holder of Permission forwards or exposes that capability without re-checking the requester.
Classic Unix setuid
a setuid binary writes to a path supplied by a caller without checking the caller has rights to that path.
RPC authority confusion
a service-account RPC accepts a target argument from an untrusted client and acts on it with the service account's broad privileges.
Relationships
Builds on
References
Infrastructure
A capability-bearing entity
Mind
Autonomous Goal-Directed Entity
Infrastructure
Authorization grant
Nothing in this library builds on this pattern yet.
Reference