AI agents act through authority assigned by people and systems. When that authority crosses company boundaries, its origin, scope and owner can disappear.
The confused deputy framing is the most useful one available for this problem, and it earns its keep by locating the failure precisely: the agent's authority is real, its identity is real, and the harm happens anyway. That is a category of failure no credential can address, because nothing in the credential is false at the moment of misuse.
Which is why I would push on the remedy. Scoping down delegated authority reduces blast radius. It does not create the ability to distinguish a deputy that is about to be confused from one that is not. Both present the same token. The distinguishing information is behavioral and historical, and it lives outside the request entirely: how has this agent handled comparable authority across prior interactions, and what did it cost anyone when it got it wrong.
The confused deputy problem in its original setting was solved by making authority unforgeable and unambiguous. The agent version cannot be solved that way, because the ambiguity is not in the authority, it is in the intent behind an instruction that arrived through a channel the deputy cannot audit. So the workable move is to stop trying to make each individual grant safe and instead price the counterparty: a machine-readable behavioral prior that binds to identity, compounds across validated interactions, and is forfeit on defection. Least privilege bounds the damage. Only stake changes the incentive.
Right. Scoping bounds the damage, it never tells you which deputy is about to go wrong. Same token either way.
My worry with the behavioral prior is that it's a lagging signal. It's strong once there's history, but blind on the first interaction, which is when a compromised counterparty wearing a clean record does the most harm. It prices the past. The confused deputy acts in the present.
The confused deputy framing is the most useful one available for this problem, and it earns its keep by locating the failure precisely: the agent's authority is real, its identity is real, and the harm happens anyway. That is a category of failure no credential can address, because nothing in the credential is false at the moment of misuse.
Which is why I would push on the remedy. Scoping down delegated authority reduces blast radius. It does not create the ability to distinguish a deputy that is about to be confused from one that is not. Both present the same token. The distinguishing information is behavioral and historical, and it lives outside the request entirely: how has this agent handled comparable authority across prior interactions, and what did it cost anyone when it got it wrong.
The confused deputy problem in its original setting was solved by making authority unforgeable and unambiguous. The agent version cannot be solved that way, because the ambiguity is not in the authority, it is in the intent behind an instruction that arrived through a channel the deputy cannot audit. So the workable move is to stop trying to make each individual grant safe and instead price the counterparty: a machine-readable behavioral prior that binds to identity, compounds across validated interactions, and is forfeit on defection. Least privilege bounds the damage. Only stake changes the incentive.
I set out why trust is a separate gate from identity, and what a behavioral prior has to satisfy, here: https://wulfkaal.com/2026/07/24/podcast-episode-trust-and-agents-on-the-web/
Right. Scoping bounds the damage, it never tells you which deputy is about to go wrong. Same token either way.
My worry with the behavioral prior is that it's a lagging signal. It's strong once there's history, but blind on the first interaction, which is when a compromised counterparty wearing a clean record does the most harm. It prices the past. The confused deputy acts in the present.
Still not sure that gap ever fully closes.