# 有界智能体：多智能体AI系统的委托安全机制

- 来源：HuggingFace Daily Papers（社区热门论文）
- 发布时间：2026-08-16 08:00
- AIHOT 分数：65
- AIHOT 链接：https://aihot.virxact.com/items/cmt1u0dnk08seroov98nh4gl9
- 原文链接：https://arxiv.org/abs/2608.15888

## AI 摘要

论文提出Agentic Principal Chain（APC），通过六项授权检查追踪并限制多智能体系统中的委托权限，防止越权组合与子代理权限扩散。在3,154个实例评测中，AgentDojo四个域的数据外泄从75-100%降至0%，并拦截全部544例InjecAgent数据窃取；授权延迟第99百分位仅0.24毫秒。实现、评测工具与数据均已公开。

## 正文

LLM-based agents can act on behalf of a user to access cloud services, call tools, or invoke agents. At session start, the agent's permissions are set but remain static, and each request is evaluated independently, without considering prior actions. Within its permissions, an agent may act contrary to the delegated task, combine individually permitted actions into a prohibited outcome, or delegate authority to a sub-agent without limiting it. A prompt injection poses a risk only if the agent has authority to perform such actions; this is therefore a problem of authorization architecture, not just the model. The Agentic Principal Chain (APC) tracks delegated authority from one principal to the next. APC evaluates each request against the accumulated session state using six authorization checks. APC carries forward and restricts delegated scope and budgets. Using composition closure, APC checks requests against prior actions to prevent prohibited combinations and enforces the decision outside the model. We prove Blast Radius Monotonicity and Composition Soundness for APC implementations; Composition Soundness is limited to prohibited combinations under a complete restriction set and serialized admission. We evaluated 3,154 instances including InjecAgent, AgentDojo, and ASB. Our compromised-model evaluation tests APC independently of model behavior by inserting the ground-truth attack call after the first legitimate tool call. AgentDojo exfiltration fell from 75-100% to 0% across all four domains; APC blocked all 544 InjecAgent data-stealing cases. Intent binding reduced destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%. Authorization latency was 0.24 ms at the 99th percentile on an idle host; across 949 AgentDojo task-injection pairs, utility was 8.6 and 13.9 percentage points lower in the two settings. Implementation, evaluation tools, and data are publicly available.