A new research paper from Hugging Face introduces the Agentic Principal Chain (APC), an authorization model designed to secure multi-agent AI systems against delegation abuses and harmful action combinations. The work addresses a critical gap: LLM agents typically have static permissions set at session start, and each request is evaluated independently, ignoring prior actions.
The authors argue that prompt injection attacks are fundamentally an authorization problem, not just a model robustness issue. An agent may combine individually permitted actions into a prohibited outcome or delegate authority to a sub-agent without proper limits. APC tackles this by tracking delegated authority from one principal to the next, evaluating each request against accumulated session state using six authorization checks.
Key features include carrying forward and restricting delegated scope and budgets, and using composition closure to check requests against prior actions, preventing prohibited combinations. Enforcement is done outside the model, ensuring decisions are not influenced by the model itself.
The paper proves two properties for APC implementations: Blast Radius Monotonicity and Composition Soundness (the latter limited to prohibited combinations under a complete restriction set and serialized admission). In evaluations across 3,154 instances, APC reduced AgentDojo exfiltration from 75-100% to 0% across all four domains, blocked all 544 InjecAgent data-stealing cases, and cut destruction from 38.6% to 4.0% and manipulation from 90.5% to 12.1%.
Authorization latency was just 0.24 ms at the 99th percentile on an idle host. Utility dropped by 8.6 and 13.9 percentage points in two AgentDojo settings. The implementation, evaluation tools, and data are publicly available.