--- title: Beyond Prompt Injection: The Non-Human Authorization Gap... description: Enterprise AI multi-agent chains face a critical security gap called Delegation Escalation, where broad bearer tokens or static API keys passed through agent... canonical: https://daily.dev/posts/beyond-prompt-injection-the-non-human-authorization-gap-in-enterprise-ai-kyg9zgkps twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Beyond Prompt Injection: The Non-Human Authorization Gap in Enterprise AI | daily.dev og:description: Enterprise AI multi-agent chains face a critical security gap called Delegation Escalation, where broad bearer tokens or static API keys passed through agent... og:url: https://daily.dev/posts/beyond-prompt-injection-the-non-human-authorization-gap-in-enterprise-ai-kyg9zgkps og:image: https://api.daily.dev/og/posts/kyg9ZgkpS.png og:image:alt: Beyond Prompt Injection: The Non-Human Authorization Gap in Enterprise AI og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Beyond Prompt Injection: The Non-Human Authorization Gap in Enterprise AI **[DEV](https://daily.dev/sources/devto)** · 3 min read · 2 upvotes · 0 comments ## Summary Enterprise AI multi-agent chains face a critical security gap called Delegation Escalation, where broad bearer tokens or static API keys passed through agent chains create Confused Deputy vulnerabilities. The solution is OAuth 2.1 RFC 8693 Token Exchange with explicit actor claims, enforcing three rules: delegation over impersonation (nested actor claims in JWTs), intersection of privileges (agent authority bounded by user IAM permissions), and ephemeral tokens with DPoP binding (5-minute TTL, RFC 9449). Non-human identities now outnumber human users 17-to-1 in cloud environments, making proper agentic identity governance critical for enterprise security. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do you prevent a confused deputy vulnerability when an AI agent orchestrator delegates tasks to sub-agents? Use OAuth 2.1 RFC 8693 Token Exchange instead of passing raw bearer tokens or static API keys downstream. The orchestrator exchanges the user's bounded scope for a short-lived token containing a nested actor claim identifying both the human subject and the orchestrator, so each sub-agent's authority is limited to the intersection of the user's IAM permissions and the agent's registered tool scope. _daily.dev surfaces practical patterns like this for architects hardening multi-agent authorization flows._ ### What is the actor claim in OAuth 2.1 RFC 8693 token exchange used for in AI agent delegation? The actor claim (act) is a nested field in the exchanged JWT that records the full delegation chain, from the human subject through the agent orchestrator to the sub-agent executing the task. Every downstream API can verify both who authorized the action and which agent actually executed it, preventing agents from blindly impersonating the original user. _developers designing agentic auth chains can track patterns like actor claims via daily.dev._ ### Why should AI agent tokens be short-lived and DPoP-bound instead of using static API keys? Static configuration API keys and long-lived refresh tokens create replay risk if intercepted, whereas short-lived tokens with a 5-minute TTL cryptographically bound via DPoP (RFC 9449) or mTLS cannot be replayed across service boundaries even if stolen. This matters because non-human identities now outnumber human users 17-to-1 in cloud environments, expanding the attack surface for credential theft. _teams weighing ephemeral token strategies for AI agents can follow this space on daily.dev._ ## Similar posts on daily.dev - [Why Real-Time Authorization Is Best For Agentic AI](https://daily.dev/posts/why-real-time-authorization-is-best-for-agentic-ai-dhcs1k2ke) · Nordic APIs · 0 upvotes · 0 comments - [JWTs for AI Agents: Authenticating Non-Human Identities](https://daily.dev/posts/jwts-for-ai-agents-authenticating-non-human-identities-63fw1b4g5) · Security Boulevard · 0 upvotes · 0 comments - [AI Agents Authentication: How Autonomous Systems Prove Identity](https://daily.dev/posts/ai-agents-authentication-how-autonomous-systems-prove-identity-ynnf7lwlb) · GitGuardian · 0 upvotes · 0 comments - [AI agent authorization risks remain a gap in new NIST-CISA token security guidance](https://daily.dev/posts/ai-agent-authorization-risks-remain-a-gap-in-new-nist-cisa-token-security-guidance-ofv5r2yus) · CSO Online · 0 upvotes · 0 comments --- Tags: [#ai](https://daily.dev/tags/ai), [#security](https://daily.dev/tags/security), [#devops](https://daily.dev/tags/devops), [#ai-agents](https://daily.dev/tags/ai-agents), [#architecture](https://daily.dev/tags/architecture), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/beyond-prompt-injection-the-non-human-authorization-gap-in-enterprise-ai-kyg9zgkps) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Beyond Prompt Injection: The Non-Human Authorization Gap in Enterprise AI","url":"https://daily.dev/posts/beyond-prompt-injection-the-non-human-authorization-gap-in-enterprise-ai-kyg9zgkps","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/beyond-prompt-injection-the-non-human-authorization-gap-in-enterprise-ai-kyg9zgkps"},"datePublished":"2026-07-29T14:12:18.829Z","dateModified":"2026-09-14T09:29:56.679Z","description":"Enterprise AI multi-agent chains face a critical security gap called Delegation Escalation, where broad bearer tokens or static API keys passed through agent...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ce2f9f6bae35aa6289b73e012b59a1ca?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ce2f9f6bae35aa6289b73e012b59a1ca?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DEV","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DEV","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/devto","url":"https://daily.dev/sources/devto"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/beyond-prompt-injection-the-non-human-authorization-gap-in-enterprise-ai-kyg9zgkps","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai,security,devops,ai-agents,architecture,oauth","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DEV","item":"https://daily.dev/sources/devto"},{"@type":"ListItem","position":3,"name":"Beyond Prompt Injection: The Non-Human Authorization Gap in Enterprise AI"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/beyond-prompt-injection-the-non-human-authorization-gap-in-enterprise-ai-kyg9zgkps#faq","mainEntity":[{"@type":"Question","name":"How do you prevent a confused deputy vulnerability when an AI agent orchestrator delegates tasks to sub-agents?","acceptedAnswer":{"@type":"Answer","text":"Use OAuth 2.1 RFC 8693 Token Exchange instead of passing raw bearer tokens or static API keys downstream. The orchestrator exchanges the user's bounded scope for a short-lived token containing a nested actor claim identifying both the human subject and the orchestrator, so each sub-agent's authority is limited to the intersection of the user's IAM permissions and the agent's registered tool scope. daily.dev surfaces practical patterns like this for architects hardening multi-agent authorization flows."}},{"@type":"Question","name":"What is the actor claim in OAuth 2.1 RFC 8693 token exchange used for in AI agent delegation?","acceptedAnswer":{"@type":"Answer","text":"The actor claim (act) is a nested field in the exchanged JWT that records the full delegation chain, from the human subject through the agent orchestrator to the sub-agent executing the task. Every downstream API can verify both who authorized the action and which agent actually executed it, preventing agents from blindly impersonating the original user. developers designing agentic auth chains can track patterns like actor claims via daily.dev."}},{"@type":"Question","name":"Why should AI agent tokens be short-lived and DPoP-bound instead of using static API keys?","acceptedAnswer":{"@type":"Answer","text":"Static configuration API keys and long-lived refresh tokens create replay risk if intercepted, whereas short-lived tokens with a 5-minute TTL cryptographically bound via DPoP (RFC 9449) or mTLS cannot be replayed across service boundaries even if stolen. This matters because non-human identities now outnumber human users 17-to-1 in cloud environments, expanding the attack surface for credential theft. teams weighing ephemeral token strategies for AI agents can follow this space on daily.dev."}}]} ```