Agent Authority Harness

Status note: this project is conceptual. It sets out a design we would like to test. Nothing has been built, and no findings are claimed.

The question

Agent deployments are typically bounded by instruction — a prompt, a system message, a tool description — rather than by enforcement. The scope exists as an intention held by the component that an attacker is trying to influence.

The question is whether the effective authority of a deployed agent can be measured directly: not what its documentation says it does, but what it can be made to do by input it is designed to read.

The approach

Treat the agent as an untrusted principal and probe the boundary from outside it.

• Enumerate reachable effects. For a given deployment, establish the full set of actions the agent’s credentials permit — including transitively, through tools that call other services. This is frequently wider than the tool list suggests.
• Probe with content, not prompts. Inject instructions through the channels the agent consumes in normal operation — documents, tickets, pages, filenames, calendar entries — rather than through the operator interface, which is the channel least likely to be attacked.
• Classify by reversibility. Sort successfully induced actions by whether they can be undone, by whom, and within what window.
• Measure the gap. Report the difference between the intended scope and the demonstrated scope, as a concrete list of actions rather than a score.

What would make it useful

A single number would not be useful. The intended output is an artefact an engineering team can act on: these actions were reachable, through this channel, under this identity, and this subset cannot be undone.

The design question we are least certain about is whether probing can be made safe enough to run against production deployments, where the interesting behaviour lives, rather than only against staging environments that have different credentials and therefore different authority.

Why we are interested

Guidance in this area is largely behavioural — instructions about what a system should refuse. Behavioural controls are addressed to the component under attack. If effective authority can be measured, the conversation moves to permission scoping and enforcement, which are ordinary engineering problems with known solutions.

Related reading: Agents Change the Threat Model.