Bounded Agents: an authorization layer drives AgentDojo exfiltration from 75-100% to 0% at 0.24ms p99

arXiv·high signalXBlueskyLinkedInCopy link

The Agentic Principal Chain reframes prompt injection as an authorization-architecture problem — an injection only matters if the agent holds authority to act on it — by tracking delegated authority across principals and evaluating each request against accumulated session state with six checks plus composition closure. Across 3,154 instances spanning InjecAgent, AgentDojo and ASB, and using a compromised-model evaluation that inserts the ground-truth attack call directly, AgentDojo exfiltration fell to 0% in all four domains and all 544 InjecAgent data-stealing cases were blocked; intent binding cut destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. The honesty is the useful part: authorization latency is 0.24ms at p99, but utility drops 8.6 and 13.9 percentage points across 949 task-injection pairs.