The most consequential difference between a chatbot and an agent is not autonomy. It is authority. The moment a model can send a message, query a database, or modify a record, an ambiguous instruction becomes a security decision.
This is an old problem in a new interface: a more privileged component is induced to misuse its authority on behalf of a less privileged one. The model is the confused deputy. Natural language is the call stack.
The boundary disappears in context
Most agent designs flatten instructions, retrieved documents, tool results, and user messages into one context window. The model can distinguish their labels, but it does not enforce a security boundary between them. A sentence inside an untrusted document can compete directly with the developer’s intended policy.
That creates three recurring failure modes:
- Authority without provenance. The agent acts without tracking which source justified the action.
- Capability without scope. A broadly authorized tool is available during a narrowly scoped task.
- Intent without confirmation. The system infers user approval for an irreversible action.
Constrain the action, not the prose
Prompt hardening can improve behavior, but it should not carry the weight of authorization. Put enforcement around the model’s output.
For every tool call, evaluate a small decision record: the requesting principal, the source of the triggering instruction, the exact capability requested, the affected resource, and whether the action is reversible.
The model may propose an action. A deterministic control should decide whether that action is allowed.
Tool credentials should be short-lived and task-scoped. High-impact calls should require an explicit approval bound to the precise action—not a blanket approval granted earlier in the session.
A practical review
Start with one end-to-end agent workflow. Mark every place information enters, every place authority expands, and every action that changes external state. Then ask:
- Can untrusted content reach this decision?
- What identity and scope does the tool actually receive?
- Can we explain which instruction authorized the action?
- What happens when the model is confidently wrong?
Agent security becomes tractable when the architecture makes those answers explicit.