# Agents Can Combine Permitted Actions Into a Prohibited Outcome _A preprint posted on August 16, 2026 models agent permissions as a chain rather than a fixed grant and argues an injected instruction only causes harm when the agent already holds the authority to act on it. Its benchmark results are strong and entirely synthetic._ By Johannes Keienburg, CEO & Founder Published: 2026-08-21 Source: https://www.cakewalk.security/blog/bounded-agents-authorization-architecture --- ## A Prompt Injection Only Lands If the Agent Already Holds the Authority Reading a confidential document is permitted. So is sending an external message. Doing both in one session produces the result a policy forbids. Xabier Muruaga posted a preprint to arXiv on August 16, 2026. Its authorization model judges each request against everything the session has already done. The paper's central claim is about [prompt injection](/glossary/prompt-injection): an injected instruction only causes harm when the agent already holds the authority to act on it. Permissions fixed at session start cannot see a combination coming. > These are authorization failures, not model-alignment failures: they remain possible no matter how robust the model is to a given injection, because the underlying authority structure permits them. _Xabier Muruaga, Bounded Agents_ The paper sorts the gap three ways. An agent takes permitted actions unrelated to its task. A sub-agent claims authority beyond what was passed to it, or hands it on without narrowing it. Or it arrives at a forbidden result by [combination](/glossary/compositional-risk), where no single permission is the one that failed. The model follows authority along the delegation chain, the run of principals from the person who starts a task down to each sub-agent and tool. No hop may grow the [blast radius](/glossary/blast-radius). ## The Results Are Strong and the Benchmarks Are Synthetic Across 3,154 instances from public benchmark suites, AgentDojo [exfiltration](/glossary/data-exfiltration) fell from a range of 75 to 100 percent to zero in all four domains. All 544 InjecAgent data-stealing cases were blocked. Enforcement is not free. Across 949 task-injection pairs, task utility landed 8.6 and 13.9 percentage points lower in the two settings tested. > External: all benchmarks are synthetic, and no production-deployment data is presented; this is a deliberate scope choice, as the primary claims are structural. _Xabier Muruaga, Bounded Agents_ The author draws the rest of the boundary. Adaptive attacks were self-designed rather than externally red-teamed. The compromised-model test inserts its attack at a fixed point after the first legitimate call. It complements role-based and [attribute-based access control](/glossary/abac) rather than replacing them. This is a single-author preprint without peer review, whose author discloses standards-body involvement and language-model help in the writing. What it bounds is which authority gets exercised and in what combinations, never whether one authorized action was the right call. Nothing in the model records [which person asked for it](/blog/mcp-spec-agent-access-control-accountability). > Permissions are set by design, before any model sees a prompt. An agent acts for a named person and carries the least access that person's task needs. Every action gets evaluated when it runs, against who is behind it, what is being done and which app it acts on. That evaluation stays deterministic. One record holds what was allowed, denied or escalated. Because we govern single-agent sessions today, the chained delegation modeled here runs ahead of what we ship. The part that already holds is where the check belongs. _Comment from Gil Röder, CPO & Co-Founder_ Source: Xabier Muruaga, "[Bounded Agents: Delegation Security for Multi-Agent AI Systems](https://arxiv.org/abs/2608.15888)", August 16, 2026.