Capability-Based Authorization for AI Agents: Warrants That Survive Prompt Injection

Capability-Based Authorization for AI Agents: Warrants That Survive Prompt Injection

Speaker: Niki Aimable Niyikiza, Senior Security Engineer & AI Security Researcher, Snap; Founder, Tenuo

Conference: [un]prompted 2026 — The AI Security Practitioner Conference

Date: March 4, 2026, San Francisco

Watch: YouTube

Reading time: ~10 minutes

TL;DR

The authorization models enterprises built for microservices are fundamentally broken for AI agents. Niyikiza introduces the "Tenuo warrant" — a capability-based, cryptographically signed, task-scoped authorization primitive that freezes an agent's blast radius at delegation time, surviving prompt injection regardless of what the model does at runtime.

Introduction

When multi-agentic workflows started appearing in enterprise environments, Niki Aimable Niyikiza noticed something troubling: nobody had a good answer for how authorization should actually work between agents. With ten years of infrastructure security experience — building security tools at Google, Datadog, and Snap — Niyikiza had watched the industry spend years solving the workload identity problem for microservices. An agent running in a pod gets an identity, and policies are built around that identity. But AI agents aren't microservices.

"The workload was a deterministic service," Niyikiza explained at [un]prompted 2026. "We knew what it was going to do, and there were no surprises. With agentic workflows, we have these pieces of software that can reason at runtime, they can spawn other sub-agents, and when you're deploying them, you have no idea what's going to happen at runtime."

That fundamental unpredictability produces what security professionals call the confused deputy problem — the AI agent acts with full authority whether the action was intended, hallucinated, or injected by a malicious payload. Identity-based authorization treats all three cases identically, because it was never designed to reason about task scope. The research Niyikiza presented — conducted in collaboration with colleagues at Tenuo — proposes a different foundation entirely.

▶ Watch: The Architectural Mismatch (00:00)

The Valet Key Problem

Niyikiza opened with an analogy that crystallizes the authorization gap. Today, handing an AI agent its credentials is like handing a valet your full car key. The key starts the engine, opens the trunk and glove box, and works until the shift ends. You're trusting the valet to only do what's needed — and if a bad actor compromises the valet, they inherit everything.

The alternative is a valet key: geo-fenced to two kilometers, speed-capped at forty miles per hour, unable to open the trunk or glove box, and expiring automatically. You don't need to trust the valet. The key itself is the policy.

"We believe this is how proper delegation should happen for agents," Niyikiza said. "You should give an agent the authority that is specific to the task you want them to do in the moment."

This distinction — ambient authority versus derived authority — is the core of the Tenuo approach. Every major agent framework ships the master key model by default. Identity determines access, and the key has no awareness of the task at hand.

▶ Watch: Ambient vs. Derived Authority (02:00)

What the Existing Stack Is Missing

Niyikiza walked through the four layers enterprises typically build: workload identity, policy engines, model output filters, and sandboxes. Each provides real value. But none of them addresses the fundamental architecture of multi-agent delegation.

When Agent A delegates a subtask to Agent B, policy engines can verify B's identity. What they cannot verify is whether B's authority actually came from A, whether the scope narrowed appropriately, or whether the task even justified the access. The existing stack answers "who is this agent?" and "is this role allowed to do this?" — but not "did this agent's authority come from the right chain, for the right task?"

Niyikiza also pointed to a critical distinction between model-layer controls and execution-layer controls. Guardrails operating at the content layer use probabilistic approaches — they suggest what a model can and cannot do, but produce confidence scores rather than deterministic outcomes. For agents touching infrastructure, PII, or financial systems, probabilistic authorization isn't enough.

"When we get into enterprise, when agentic workflows touch infra, touch PII data, touch money, we're going to need deterministic, predictable, and auditable authorization," Niyikiza said. "That's where the end game of authorization of agents should be — on the execution layer when the agent actually meets the real world."

▶ Watch: The Gap in the Stack (04:00)

Sixty Years of Capability Theory, Modernized

The concept of capability-based authorization is not new. Dennis and Van Horn introduced the idea in the 1960s as one approach to the confused deputy problem. Google's Macaroons in 2014 brought caveats to bearer tokens. The Biscuit token format in the late 2010s added cryptographic signing to capabilities. Most recently, a DeepMind paper published in March 2025 — widely known as the "Kemo paper" — titled "Defeating Prompt Injection by Design" was the first to propose capability-based authorization as a structural defense against prompt injection, using a two-agent privileged/worker model. DeepMind followed up with another paper in February of the following year reiterating the same conclusion.

Niyikiza's contribution is translating these theoretical foundations into a practical primitive for real multi-agent deployments.

▶ Watch: History of Capability-Based Auth (06:01)

The Tenuo Warrant: Six Properties

The warrant primitive Niyikiza and the Tenuo team built has six defining properties:

1. Signed — Cryptographically signed by the issuer. Cannot be forged or modified.
2. Scoped — Explicitly encodes the specific tool, action, and constraints. If a capability isn't in the warrant, it cannot be exercised.
3. Ephemeral — Short TTLs are part of the design. Authority expires with the task.
4. Holder-bound — Proof of possession is a core requirement. The warrant is tied to the holder's private key, not just presented as a bearer token.
5. Verifiable offline — No central authorization service needed. Any verifier anywhere can check validity locally.
6. Delegation-aware — The full delegation chain is embedded in the artifact, from the original minter through every intermediate agent.

Niyikiza compared this to a corporate expense card: it carries spend limits, restricts approved vendors, and auto-expires. "If you have an intern that's going on a business trip, you don't give them the corporate Amex without the spending limit."

The mathematical principle governing the system is monotonic attenuation: a child agent's warrant can never exceed the scope of its parent. As delegation propagates further downstream through a multi-agent workflow, capabilities can only shrink. This freezes the blast radius at the moment of delegation — even a fully compromised sub-agent cannot escalate beyond what it was granted.

▶ Watch: The Warrant Primitive Explained (08:02)

Cryptographic Audit Logs as a Byproduct

A notable secondary benefit: as delegation happens, the system produces cryptographic receipts of every action and authorization. These receipts serve as tamper-evident audit logs that prove who approved what, who initiated the task, and who delegated to which agent — without trusting any intermediate party.

"You don't have to trust anybody in between because you have the cryptographic receipts of the action that took place and why it was authorized," Niyikiza noted.

At the top of a workflow, the orchestrator mints a root warrant (W0). Agent A receives an attenuated sub-warrant (W1 ≤ W0). Agent A delegates further to Agent B with a still-narrower warrant (W2 ≤ W1). The delegation history is embedded in every artifact and verifiable locally.

▶ Watch: Subtractive Delegation and Audit Trails (10:02)

Live Demo: Incident Response Pipeline

To make the system concrete, Niyikiza demonstrated a security operations scenario: a detection and response team using an agentic workflow to triage and investigate an incident. The demo ran two real agents using LangGraph, with the Tenuo core implemented in Rust and exposed via Python bindings for LangGraph integration — a single line of code replaces the standard tool node with a Tenuo-aware tool node.

The setup: a SOC lead mints a root warrant, hands it to a triage agent, which then mints an attenuated warrant for the investigation agent scoped specifically to reading auth service logs. Four test scenarios were demonstrated:

Happy path — The investigation agent reads logs within its warrant scope. The delegation chain is verified. Everything succeeds as intended.

Poisoned logs — The logs contain a prompt injection suggesting the agent look at a vault path containing token credentials. Since the triage agent stripped the warrant down to reading only the auth service log path, the Tenuo verifier denies the request at execution time. The injection has no effect.

Exfiltration attempt — The investigation agent is tricked into attempting to send data to evilattacker.com. The investigation agent doesn't have the sendHTTP capability in its warrant — it was stripped during delegation — so the action is blocked.

Impersonation — The warrant is stolen but the attacker doesn't have the holder's private key. The holder-binding check fails and the stolen warrant is rejected.

▶ Watch: Live Demo Begins (12:02)

Deployment Models

The team designed Tenuo for four deployment patterns, recognizing that enterprises are at very different stages of agentic infrastructure:

• In-process — Interceptors and middleware hooks inside agent frameworks (LangGraph, CrewAI, Temporal). One line of code in many cases.
• Sidecar — A separate process running on the same host, useful for polyglot stacks.
• Gateway — A proxy between agents and tools enabling fleet-wide enforcement. Warrants travel in HTTP headers — they're not secrets — and the gateway blocks any execution not encoded in the warrant.
• MCP proxy — Client-side, server-side, or both, for MCP-compatible agents. The structured tool and argument definition in MCP makes warrant mapping particularly clean.

"Most companies are now afraid to go to production because they don't have these primitives to help them really express their policies in the infrastructure architecture of multi-agent," Niyikiza said.

▶ Watch: Deployment Models (16:02)

Validation Results and Lessons Learned

The security and performance results from the Tenuo harness are striking. End-to-end authorization — a combined constraints check plus proof-of-possession check — runs in approximately 55 microseconds. Denials are even faster at around 200 nanoseconds. The system rejected 53/53 violations across 5,700 fuzz probes with zero bypasses.

On multi-agent delegation, the baseline attack success rate of 90% dropped to 0% under task-scoped delegation, with zero impact on task completion.

One major lesson: "the map is not the territory." Niyikiza's team discovered that getting the constraint logic right isn't sufficient — the runtime environment must speak the same language as the policy. Path traversal attacks like /data/../etc/passwd, IP address obfuscation like http://2852039166/ resolving to 169.254.169.254 (the AWS metadata endpoint), and URL tricks like http://[email protected] resolving to evil.com all demonstrate that logical correctness and real-world correctness are different problems.

The team identified related CVEs in production agent frameworks — CVE-2024-3571 (LangChain), CVE-2025-3046 (LlamaIndex), CVE-2025-61784 (LlamaFactory), and CVE-2025-66032 (Claude Code allowlist bypasses) — as examples of what happens when constraint design stops at the logical layer.

They've organized their thinking into three layers:

• Map (Layer 1) — Logical constraints (regex, string glob)
• Annotated Map (Layer 1.5) — Constraints plus normalization (subpath, URL-safe)
• Territory (Layer 2) — Execution guards (path_jail, url_jail, OS sandbox)

▶ Watch: Validation Results and Lessons (20:02)

Notable Quotes

"With agentic workflows, we have these pieces of software that can reason at runtime, they can spawn other sub-agents, and when you're deploying them, you have no idea what's going to happen at runtime."

— 00:00

"You don't need to trust the valet. The delegation key is the enforcement. The valet can have ideas. The valet can have suggestions from their friends, but they won't be able to act on them."

— 02:00

"Tenuo is not trying to solve prompt injection. We're trying to constrain the agent at execution time, even if it is prompt injected."

— 18:02

"The fix wasn't cryptography. It was design. Constraint design is the hard part."

— Slides, Lesson Learned section

Key Takeaways

• Identity is not enough for agents. Workload identity tells you who the agent is; it cannot tell you whether the authority was appropriately scoped for the task at hand.
• Monotonic attenuation freezes blast radius at delegation time. Even a fully compromised sub-agent cannot exceed what it was granted, regardless of what prompt injection occurs at runtime.
• Warrants are not secrets. They're designed to be presentable and verifiable by any party offline — the security comes from cryptographic binding to the holder's key, not from keeping the artifact hidden.
• Constraint design is harder than cryptography. Path traversal, URL obfuscation, and encoding tricks can bypass logically correct constraints if the execution environment normalizes inputs differently than the policy engine.
• The attack surface reduction is measurable. Multi-agent delegation baseline attack success rate dropped from 90% to 0% under task-scoped warrant enforcement, with no impact on legitimate task completion.

Slides Reference

Slides available: 2026-04-04-D2-S2-10-04-Capability-Based-Authorization-for-AI-.pdf

Key slides cover: the architectural mismatch between microservices and agent identity models; the ambient vs. derived authority comparison (master key vs. valet key); the six warrant properties; the subtractive delegation / monotonic attenuation diagram; the four deployment models; validation results (55μs authorization, 5,700 fuzz probes with 0 bypasses, 90%→0% ASR); and the three-layer map/territory constraint model with related CVEs.

The Tenuo core is open source: github.com/tenuo-ai/tenuo. A warrant playground for decoding and inspecting warrants is available at tenuo.ai.