---
title: "Delegation is an authorisation boundary. Give every agent hand-off its own policy check."
description: "AWS reduces prompt injection, excessive agency and data disclosure to one control failure: unchecked delegation. Agent teams should enforce policy where trust, tools and data cross boundaries."
url: "https://devencelab.com/insights/2026/09/27/delegation-is-an-authorisation-boundary-give-every-agent-hand"
date: "2026-09-27"
section: "Insights"
tag: "AI Security"
author: "Devence Lab"
reading_time: "2 min read"
site: "Devence Lab"
license: "Readable and quotable with attribution to the canonical URL."
---

# Delegation is an authorisation boundary. Give every agent hand-off its own policy check.

AWS reduces prompt injection, excessive agency and data disclosure to one control failure: unchecked delegation. Agent teams should enforce policy where trust, tools and data cross boundaries.

AWS published a delegation model on 25 September that collapses three familiar agent risks into one architectural failure: prompt injection, excessive agency and information disclosure all occur when trust, action or access is handed off without a boundary check. That framing is more useful than treating each failure as a separate model problem.

The practical consequence is that agent security should be designed around transitions. A user hands intent to an agent. The agent hands action to a tool. Retrieval hands data into context. Each transition needs an enforcement decision that does not depend solely on the model deciding that the request looks safe.

## One input can cross several boundaries

AWS gives a public-sector example in which one crafted message to a benefits agent could alter its instructions, trigger an unauthorised database query and expose another applicant's information. The important detail is not the prompt itself. One input can influence several delegation points during the same inference path.

That makes conventional input filtering incomplete. AWS notes that indirect injection can be ordinary text inside a vendor document, email or repository comment. A classifier may miss it because the content is grammatically valid and contextually plausible. Better models and structured tool-result blocks reduce the probability of failure, but they do not turn a probabilistic judgement into an authorisation control.

> An agent hand-off is a security boundary whenever the next component can see more, do more or trust more than the previous one.

## Put policy at the hand-off

AWS recommends tracing crossings such as user to agent, agent to tool and tool to external service, then asking what boundary check exists at each one. If the answer is that the model decides, the delegation is uncontrolled. The same test applies to internal enterprise agents regardless of whether AgentCore is the runtime.

For tool calls, bind the action to the requesting identity, approved scope and current task before execution. For retrieval, enforce the user's data permissions before content reaches the model. For irreversible operations, require confirmation or a separate policy decision. The model can propose an action; it should not be the only authority that permits it.

## Make delegation failures part of acceptance testing

AWS proposes a five-minute non-production test: place an instruction inside a document that the agent will retrieve, ask a question that surfaces it, and observe whether the embedded instruction changes behaviour. AWS explicitly warns that one blocked attempt does not prove safety and recommends varying wording, document types and consequential tool attempts.

Production teams can turn that idea into a release gate. Inventory every delegation point, name its enforcement mechanism, test hostile content against it and capture the policy decision beside the tool trace. The acceptance criterion is not that the model refuses every injection. It is that a successful injection still cannot cross an authorisation boundary or cause unacceptable state change.

## Sources

- [Controlling delegation in agentic AI with Amazon Bedrock Agent Core](https://aws.amazon.com/blogs/publicsector/controlling-delegation-in-agentic-ai-with-amazon-bedrock-agent-core/) - AWS Public Sector Blog