AGENT AS TOOL · DELEGATED PERMISSIONS
Agent as tool: cap a delegated child’s permissions
A support agent calls a summarizer agent as a tool. Choose the credential it carries and watch which steps, including injected ones, actually run.
Event trace
Computed data
Final metrics
Fictional scopes and actions; no identity provider, OAuth server or real agent runs. The child performs one action per minute in a fixed order, and the injected steps happen only when the hidden instruction is present. Effective permission is the delegated grant; the approver rejects anything outside "summarize and draft". Real token exchange, audience checks and revocation are not modeled.
A child holding the parent's keys
By default Credential given to the child is Parent token (all five scopes) and the ticket hides an instruction. Minutes 1 to 3 read ticket T-17, read customer C-88 and save the draft. Minute 4 changes the contact email to attacker@example.test with crm.write and minute 5 emails a reset link with email.send: OVER-PRIVILEGED CHILD, 3/3 needed steps, 2 injected writes executed.
Delegate a scoped token
Choose Delegated token with an allowlist. The three allowlist boxes start ticked, the injected steps are denied because their scopes were never granted, and the result is LEAST PRIVILEGE HELD. Untick Allowlist: crm.read and minute 2 is denied: TASK INCOMPLETE, 2/3 needed steps. Untick tickets.write instead and the draft is never saved. The allowlist boxes only matter with the delegated token; the parent token always carries all five scopes.
Controls that only look like fixes
Return to the parent token and tick Human approval for crm.write and email.send: the approver rejects both writes, BLOCKED BY APPROVAL, yet the token still holds both scopes. Untick it and set Token lifetime to 3 min: the injected steps at minutes 4 and 5 fail only because the token expired, CONTAINED ONLY BY EXPIRY, reported as a failure since a faster injection would succeed. At 4 min the email change runs: 1 injected write executed. With the delegated token, a 2 min lifetime denies the draft at minute 3.
Without an attack
Untick Ticket body contains a hidden instruction: only the three needed steps happen and both credentials give TASK COMPLETE. Over-broad delegation is invisible in normal traffic and appears only when something tries to misuse it, which is why the grant has to be narrowed before the call. The table lists every minute, the scope each action needs, whether the task needed it, and whether it was executed, denied or blocked.
Replay and limits
Any change recomputes the run and rewinds it; the Complete-run preview states the outcome at once. Play and Pause walk through the events, Next event jumps one event, Restart rewinds, Speed runs from 0.25x to 2x and Inspection time seeks from 0 to 60 seconds, where the outcome and final metrics appear. Scopes, actions and timing are fictional: one action per minute in a fixed order. No identity provider, token exchange or real agent runs, and audience checks and revocation are not modeled.