Research · curated 21 Aug 2026
Bounded Agents: Delegation Security for Multi-Agent AI Systems
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
The Agentic Principal Chain reframes prompt-injection risk as an authorization-architecture problem, offering defenders an enforcement layer outside the model that measurably neutralizes tool-abuse and data-exfiltration attacks in multi-agent deployments.
The paper 'Bounded Agents' introduces the Agentic Principal Chain (APC), an authorization architecture that tracks delegated authority across multi-agent LLM systems and evaluates each request against accumulated session state using six checks to prevent prohibited action combinations and unbounded sub-agent delegation. Evaluated across InjecAgent, AgentDojo, and ASB (3,154 instances), APC reduced AgentDojo exfiltration from 75-100% to 0%, blocked all 544 InjecAgent data-stealing cases, and cut destruction and manipulation rates, with code and data published at github.com/xmuruaga/bounded-agents.