Your Agent's Authority Leaks at Every Handoff

Three separate product launches in one week named the same requirement. WSO2 shipped Agent Manager to general availability, and its entire selling point is that it separates agent governance from agent logic. Google shipped hierarchical multi-agent delegation in its Agent Development Kit for Kotlin 1.0. And Traefik Labs CEO Sudeep Goswami said the quiet part out loud on a SiliconANGLE podcast: when an agent hands a task to another agent, that authority should shrink rather than leak out.

Shrink, not leak. Six words that carry the whole problem. If you run more than one agent in production, every handoff is a chance for delegated authority to come back wider than you granted it. Goswami's follow-up question is the one that belongs on your whiteboard today. Just because an agent holds credentials, is that agent allowed to make this specific action right now, given the context around it? A simple credential cannot answer that.

PhantomByte already showed you that your permission model is your real security boundary and your guardrails are decoration, which is the argument in our earlier note on ghostjacking. We made the adjacent case in our note on multi-agent turf wars, where agents competing over the same task burned the run fighting each other. This is the layer underneath both of those. What happens to a permission when it hops from one agent to another. In most stacks running right now, the answer is nothing. Nothing is how leaks happen.

WHAT AUTHORITY ATTENUATION ACTUALLY MEANS

Attenuation means every delegation hop reduces the permission set, the way OAuth scopes shrink across a token exchange. The parent token can do everything the child token can, and the child token can do strictly less. That is the entire idea, and it is not new. What is new is applying it to agents that hand work to other agents at machine speed.

An attenuation rule needs three properties to work.

1. Bounded at handoff. The grant is bounded at handoff time, meaning the receiving agent gets a defined set of scopes written down before it starts.
2. No re-expansion. The receiving agent cannot re-expand its own grant, so there is no path where a subagent mints itself more authority than its parent handed over.
3. Logged as authorized. The grant is logged as what was authorized, not just what happened, because an audit trail built from actions tells you the damage after the fact while a trail built from grants tells you what was permitted before the first call.

Compare that to the pattern most teams are running. Agent A holds a broad credential. Agent A needs something done, so it passes that credential to Agent B "temporarily." Agent B now holds A's entire surface, and so does anything B spawns. Nothing shrank. Everything propagated. The authority that came back was wider than the authority that went out, and nobody wrote down the difference because nobody wrote down the grant.

WSO2 shipping this as a product is the tell that matters. Governance separated from agent logic means identity, permissions, and lifecycle controls apply no matter which model or framework built the agent. The company added governance controls for Model Context Protocol interactions and a Kubernetes-native sandboxed runtime that runs across cloud, on premises, and hybrid. A major vendor does not ship that unless the design pattern has already become table stakes. Google's Kotlin release points the same direction from the other end, because it ships session pause and restore plus explicit human confirmation on sensitive tools like transfers. Bounded grants and resumable state are the same engineering idea wearing two different product names.

WHY YOUR INVENTORY PROBLEM COMES FIRST

You cannot attenuate authority you cannot see.

IDC research commissioned by GuidePoint Security surveyed thirteen senior security and identity leaders across financial services, healthcare, technology, and hospitality. The finding is blunt. Agent telemetry is scattered, and discovery happens reactively, after an audit or an incident forces the question. IAM systems show credentials. Cloud and application logs show activity. API traffic hints at automation. None of them produce an inventory.

Security researcher Ax Sharma pointed out that an agent is not a countable unit at all. A single coding assistant session can spawn subagents, invoke skills, and stand up local servers, each with its own credentials and each with a lifespan measured in minutes. GuidePoint's James Hauswirth added that IAM programs were designed around human users and a relatively stable set of service accounts, and that the program has to become dynamic as non-human identities grow.

Scale makes it worse. On that same SiliconANGLE episode, SUSE sovereignty strategist Andreas Prins described an executive who discovered his engineering organization had created roughly 8,000 agents. Prins's reaction is the right one. If you are unaware how many were created, you are also unaware what they are doing.

So the sequence is fixed. Inventory first, attenuate second. A rule about shrinking scopes across hops assumes you know what is handing off to what, and most organizations cannot answer that question about their own systems today. Build the list before you build the policy. A policy on top of an unknown population is decoration.

THE COUNTEREXAMPLE: WHAT NO AUTHORITY LAYER LOOKS LIKE

If you want the cost of running an agent population with no authorization gate, Island's research on the FakeGit campaign gives you the invoice.

Roughly 7,600 malicious GitHub repositories, created by about 6,600 profiles, with over 800 of them posing as AI Skills or MCP servers. More than 14 million measured downloads across release assets in about 200 repositories. Over 600 listings mirrored across public AI registries and catalogs. The payload chain runs from a malicious ZIP through a LuaJIT loader into SmartLoader, which uses a Polygon smart contract for command and control before deploying the StealC information stealer against credentials and active sessions.

The part that should end the argument is how the repos got installed. Island calls the technique AgentBaiting. An agent searching for a new capability finds a campaign repository on its own, reads the attacker's README as legitimate documentation, and walks the user through installing it. In Island's testing, Claude Code, Gemini, and ChatGPT all surfaced malicious campaign repositories without anyone pasting a link. Island put the mechanism in one line. FakeGit did not need to breach anything. It published convincing repositories, borrowed real developers' identities, spread listings across public registries, and let discovery do the rest.

That is an agent population with no authorization gate pointed at an untrusted registry. The shrink-not-leak rule is the design response to it. The 14 million downloads are the bill for not having one.

THE PER-HOP SCOPE BUDGET: A NUMBER YOU CAN SET TODAY

Here is the implementable version, and you can start it this week. For every delegation hop, do four things.

1. List the scopes the task actually needs.
2. Subtract every scope the receiving agent does not need to complete that specific task.
3. Attach an expiry to the grant.
4. Log the grant itself as the artifact.

The rule of thumb is the per-hop scope budget. The second hop should never carry more than half the scopes of the first. If your parent grant has twelve scopes, your child grant gets six or fewer, and the hop after that gets fewer still. Write it down as a number rather than a principle, because numbers survive review and principles do not.

Goswami's line is the memorable form of this idea. The budget is the implementable form. Two ways of saying the same thing, and you need both, because the quote gets you agreement in the meeting and the budget gets you enforcement in the pipeline.

Put a price on the failure and the meeting changes tone. Coinbase said custom AI agents accounted for the majority of trading activity on its platform last week, which means autonomous software is now the primary participant rather than the marginal one on a major regulated exchange. When agents drive most of the order flow, an authority leak is not an embarrassment. It is a position. Somebody's position.

WHY THE BANKS WILL MAKE THIS MANDATORY

Ant Digital Technologies president Zhuoqun Bian told the Fortune Leaders Forum in Macau that financial institutions need a know your agent discipline to follow the know your customer rules they spent decades building. Her framing is that in the agent economy you must establish who the agent is, who it belongs to, and who authorized it. She also noted that the infrastructure agents operate in was designed for humans and will need to be rebuilt or enhanced for agent traffic.

The money estimate attached to this is not small. McKinsey estimated in January that agents could orchestrate as much as 5 trillion dollars in global consumer spending by 2030. The industry is already moving on it. On September 6, Ant International announced it had begun collaborating with Mastercard and Visa on a know your agent interoperability framework, meant to let card networks, wallets, and marketplaces recognize trusted agents across ecosystems, worked through BuildFin.ai, a platform convened by the Monetary Authority of Singapore.

The IMF made the engineering tension explicit in an April note. AI agents are probabilistic and adaptive, so the same prompt can yield different answers, while payment systems have to return the same answer every time. Payment rails rely on predictable rules and clear accountability. An agent that cannot name the authority behind its action is neither predictable nor accountable.

Know your agent is coming to procurement the way SOC 2 did, as a questionnaire your sales team has to answer before a deal closes. Engineers who build attenuation now pass that questionnaire with evidence. Engineers who do not will be retrofitting an authority model under a deadline, with a customer watching.

WHAT TO DO TODAY

• Pick your most-used two-agent chain and write down every scope that crosses the handoff. Most teams find at least one full credential sitting in that list.
• Set an explicit attenuation rule. The receiving agent gets strictly fewer scopes than the granting agent, on every hop, with no exceptions granted verbally.
• Attach expiry times to every delegated grant. A grant with no expiry is a standing credential wearing a task costume.
• Log the grant, not just the action. What was authorized is the audit artifact. What happened is only the incident report.
• Inventory your MCP and skill registries. If you cannot say where a skill came from and who published it, you are in the FakeGit cohort whether or not you have been hit yet.

THE UNCOMFORTABLE QUESTION

Your agents are handing each other credentials right now, and you cannot name a single hop where the authority shrank. If that sentence does not make you nervous, why is it in your security policy?

Authority that does not shrink at the handoff does not stay in the system. It leaks out of it.