Confused Deputy

Definition

A confused deputy is a system with legitimate authority that is induced to use that authority for a caller or purpose that is not entitled to it. An agent or tool proxy can become such an intermediary.

The problem is authority being exercised on the wrong party’s behalf. It can occur even when the intermediary is authenticated and functioning as designed. Agent identity and caller entitlement therefore need separate treatment.

What it covers

Caller identity

Verify who is asking the intermediary to act.

Authority source

Distinguish the service’s own privilege from delegated user access.

Resource destination

Check the intended resource and tenant.

Consent and delegation

Bind approval to the relevant client and requested operation.

Map the point where a caller’s request is converted into a more privileged service operation. That handoff is where requester, resource, tenant, and grant information can be lost. Inspect both the authorization flow and the actual data-access path.

In practice

Practical design patterns by Min.

• Verify authorization at the downstream resource, not only at the agent UI.
• Use consent and client checks appropriate to the integration’s OAuth flow.
• Reject tokens not intended for the receiving service.
• Preserve requester and delegation context through proxy calls.

In an agent architecture, a tool broker can keep service credentials out of model context while still verifying the caller’s task grant. Credential isolation is useful, but the broker also needs an enforceable decision about what that caller may do.

Working example

Why the controls matter

The proxy may technically be able to retrieve every project’s documents. The example requires it to return only material authorized for the current caller, so its own broad technical access does not become an entitlement for all users.

Common pitfalls

• Treating a trusted intermediary as proof that every caller is authorized.
• Forwarding bearer tokens without validating their intended recipient.
• Reusing consent in a way that does not distinguish clients.

A prompt saying “only use your own files” does not repair a service that never checks the caller. Test the boundary with an otherwise valid request aimed at a different tenant or resource.

Questions for operational review

Use these questions to decide what evidence your team needs. They are editorial prompts, not a compliance checklist.

• Whose privilege performs the final operation?
• How is the requester’s entitlement checked?
• Can consent or tokens be reused across the wrong clients or resources?