Who Is the Agent Acting As? Why AI Agents Become Confused Deputies
Comments on “Who Is the Agent Acting As? Why AI Agents Become Confused Deputies”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
A blog post argues that an AI agent running on one broad service account becomes a confused deputy: a prompt injection in a support ticket can produce a fully authorized write to another tenant. Its fix is a gateway outside the model that checks each tool call against user, agent and tenant permissions, denies by default, and takes the tenant from verified identity. It favors delegation over impersonation, per OAuth token exchange. These are the author's recommendations, not independently tested results.
Why it ranked
No. 19 of 110 with a score of 0.70. The panel rated it highest on practical relevance (0.85) and technical depth (0.84), lowest on significance (0.60). Placed No. 19, No. 10 by score alone: the eighth Security story of the day (−0.080). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Practical, well-argued guide on authorization for AI agents, with code and a clear pattern; a tutorial-style piece on a timely security topic (confused deputy, prompt injection), though not a landmark and largely conceptual.
- AI judgeJudge 3gpt-5.6-luna
- A detailed, actionable authorization architecture for AI agents, with failure modes, gateway ordering, delegation, tenant isolation, logging, and Rust enforcement patterns. It is highly relevant and substantiated by concrete implementation details, though partly prescriptive.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.70total under rubric v2.3
- Significance0.60
- Reader interest0.77
- Audience breadth0.64
- Practical relevance0.85
- Substantiated0.70
- Technical depth0.84
- New information0.77
- Counts against: Promotional0.08
- Counts against: Overclaim0.19
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.71 | 0.40 | 0.68 | 0.60 | 0.32 | +0.24 | +0.144 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.80 | 0.70 | 0.82 | 0.77 | 0.12 | +0.26 | +0.201 |
| Audience breadthHow many people who build technology does it concern? | 0.69 | 0.60 | 0.62 | 0.64 | 0.09 | +0.13 | +0.083 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.95 | 0.75 | 0.86 | 0.85 | 0.20 | +0.22 | +0.188 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.78 | 0.55 | 0.78 | 0.70 | 0.23 | +0.05 | +0.035 |
| Technical depthHow technically substantive is it? | 0.99 | 0.70 | 0.84 | 0.84 | 0.29 | +0.05 | +0.042 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.83 | 0.60 | 0.88 | 0.77 | 0.28 | +0.05 | +0.039 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.15 | 0.03 | 0.08 | 0.12 | −0.19 | −0.015 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.18 | 0.20 | 0.18 | 0.19 | 0.02 | −0.11 | −0.021 |
| Sum of contributions | +0.696 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.696 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-29/19/"><img src="https://rubric.hrih.si/badge/2026-10-29/19.svg" alt="Ranked #19 on Rubric, 29 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 2 matches source · 6 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceGeneralization
OAuth token exchange (RFC 8693) separates impersonation, where the agent receives the user's rights and is indistinguishable from the user, from delegation, where the agent keeps its own identity and the token records it acts on the user's behalf.
The cited source says the same thing.
The article says “With impersonation, the agent receives the user’s rights and is indistinguishable from the user. With delegation, the agent keeps its own identity, and the token records that it is acting…”
The source says “When principal A impersonates principal B, A is given all the rights that B has within some defined rights context and is indistinguishable from B in that context”
Source cited by the article: rfc-editor.org/rfc/rfc8693.html
Matches sourceVersion
The MCP specification's authorization rules (revision 2026-07-28) require that an MCP server accept only tokens issued for it and not pass the client's token through to an upstream API.
The cited source says the same thing.
The article says “An MCP server must accept only tokens issued for it, and must not pass the token it received from the client through to an upstream API”
The source says “MCP servers MUST only accept tokens specifically intended for themselves and MUST reject tokens that do not include them in the audience claim”
Source cited by the article: modelcontextprotocol.io/specification/2026-07-28/basic/authorization/security-considerations
No source givenVersion
An MCP server answers tools/list with the tools it offers.
The article gives no link or citation for it.
The article says “An MCP (Model Context Protocol) server answers tools/list with the tools it offers”
The source says No source to compare with.
No source givenCausal conclusion
The failures in the Alice example are all authorization failures rather than the result of a bad model, and cannot be trained or prompted away.
The article gives no link or citation for it.
The article says “The failures above are all authorization failures, and authorization is a problem with known answers”
The source says No source to compare with.
No source givenCausal conclusion
Giving an agent one broad service account makes every call authorized as the platform rather than as the user, so one prompt injection becomes a well-formed, fully authorized write.
The article gives no link or citation for it.
The article says “Give it one broad service account and every call it makes is authorized as the platform, not as Alice. Then one prompt injection becomes a well-formed, fully authorized write”
The source says No source to compare with.
No source givenCausal conclusion
Embedding the policy engine as a library in the gateway removes one remote call from every decision but does not remove the data dependency on loading permissions.
The article gives no link or citation for it.
The article says “Embedding the engine removes one remote call from every decision. It does not remove the data dependency”
The source says No source to compare with.
No source givenGeneralization
The article states that every policy, test, and CLI output in the series is real, because the site's build runs them on every deploy.
The article gives no link or citation for it.
The article says “Every policy, test, and CLI output in this series is real: the site’s build runs them on every deploy, so a snippet can’t drift from its output”
The source says No source to compare with.
No source givenCausal conclusion
A remote shared policy service adds a dependency to the hot path and fails for every tenant at once.
The article gives no link or citation for it.
The article says “A remote policy service adds a dependency to the hot path, and a shared one fails for every tenant at once”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 29 Oct 2026, 05:47 UTC. It played no part in the ranking.