---
title: "AI Agents Are Leaking Permissions and This Framework Formally Stops It"
subtitle: "A new formal framework treats AI agent delegation as a contractual primitive, solving the recursive permission chain problem that OAuth and IAM systems can't handle."
url: "https://alphasignal.ai/news/ai-agents-are-leaking-permissions-and-this-framework-formally-stops-it"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-06-02T00:00:00.000Z"
updated: "2026-06-10T06:13:09.096Z"
type: "Paper"
topics:
  - "Agents"
  - "Security"
subtopics:
  - "Guardrails"
  - "Tool Use"
  - "Multi Agent"
upvotes: 1360
source_url: "https://arxiv.org/abs/2606.03518"
comments: 0
truncated: true
---

# AI Agents Are Leaking Permissions and This Framework Formally Stops It

> A new formal framework treats AI agent delegation as a contractual primitive, solving the recursive permission chain problem that OAuth and IAM systems can't handle.

Every time an AI agent hands off a subtask to another agent, something subtle and dangerous can happen: permissions leak, accountability chains break, and no existing system has a formal way to stop it. A new [paper from Amjad Ibrahim and Yong Li](https://arxiv.org/abs/2606.03518) proposes a compositional governance framework that treats delegation itself as a first-class, contractual primitive, rather than a side effect of token passing.

## The gap nobody plugged

The shift from AI models to AI agents changed the security threat model entirely. AI agents call APIs, execute code, manage files, and make decisions with minimal human oversight. That autonomy is the point, but it creates a structural problem for authorization systems that were designed around humans clicking consent screens.

Agents are ephemeral, operate at massive scale, form complex multi-hop delegation chains, and collaborate across domains and clouds. The standard toolkit was not built for this. OAuth has no concept of delegation chains, and in practice OAuth primarily treats tokens as impersonation rather than delegated authority. When Agent A spawns Agent B which calls Agent C, accountability chains fracture -- no system tracks which agent authorized which sub-agent to act or what permissions were passed along.

The deeper problem is structural. Every trust domain requires its own authorization server, with no mechanism for cross-domain token verification without pre-established federation. OAuth tokens are opaque to intermediaries: delegation via token exchange produces a new token with no record of the original authorization chain. And OAuth provides no holder-side scope attenuation -- only the authorization server can narrow scopes at issuance time.

![Architecture diagram showing delegation flow, hierarchical scoping, and containment relationships between user, agent, delegates, session, scope, and resource entities](https://arxiv.org/html/2606.03518v1/x1.png)

## Delegation as a contract, not a token

The core conceptual move in this paper is reframing what delegation means. Rather than treating it as a credential hand-off (the OAuth model), the authors treat it as a **contractual term** with explicit semantics: who is delegating, what scope is being granted, for how long, and what accountability obligations transfer with it.

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI](https://arxiv.org/abs/2606.03518)
- [Agent Auth: Why OAuth Wasn't Built for This](https://www.apideck.com/blog/agent-auth-oauth-ai-agents)
- [AIP: Agent Identity Protocol for Verifiable Delegation Across MCP and A2A](https://arxiv.org/pdf/2603.24775)
- [Authorization Propagation in Multi-Agent AI Systems: Identity Governance as Infrastructure](https://arxiv.org/html/2605.05440v1)
- [Managing Agent Sprawl and Identity Challenges in 2026 IT Environments](https://myitforum.substack.com/p/managing-agent-sprawl-and-identity)