Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Agent Authorization, Delegation, and Continuous Enforcement
Delegated authority never grows
Verify that authority derived through delegation never exceeds the delegating agent's current authority.
OWASP AISVS v1.01, requirement 9.5.7
In plain English
An agent can pass on only the authority it currently holds. Delegation must never give the receiver more power than the sender has, and when the sender loses access, so does everything it delegated to.
What good looks like
- Delegated permissions are always a subset of the delegator's current permissions.
- Revoking the delegator's access ends the delegated access.
- Each hop in a chain can narrow permissions and cannot widen them.
- Tests try to gain privileges through delegation and fail.
How teams usually do it
- Token exchange that narrows scopes on each hop, with the receiving service checking the whole chain.
- Tokens that can only be attenuated, such as macaroons or Biscuit tokens, where the design calls for it.
- Sub-agents that run on the delegated token alone and hold no standing credentials.
Suggested evidence
- Token scopes at each hop of a delegation chain.
- An escalation test through delegation.
- A test showing revocation reaches delegated tokens.
Common mistakes
- A sub-agent with its own broad credentials, which anyone who can delegate to it effectively shares.
- Delegated tokens that outlive the delegator's session.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.