Who Is the Agent Acting As? Why AI Agents Become Confused Deputies

A blog post argues that an AI agent running on one broad service account becomes a confused deputy: a prompt injection in a support ticket can produce a fully authorized write to another tenant. Its fix is a gateway outside the model that checks each tool call against user, agent and tenant permissions, denies by default, and takes the tenant from verified identity. It favors delegation over impersonation, per OAuth token exchange. These are the author's recommendations, not independently tested results.