Transitive Policies for Agents: Agent Permissions Don't Automatically Compose (glthr.com)

A recent analysis on agent permissions highlights a critical vulnerability in AI agent operations where permissions don't seamlessly combine—termed "transitive policies." The scenario involves three agents tasked with managing customer interactions: a Writer creates support tickets, a Reader accesses customer records, and a Sender sends emails. An attacker exploited this orchestration by crafting a convincing request that prompted the Writer to generate an internal ticket containing sensitive customer data, which ultimately led to the unauthorized disclosure of private information via email. This shows that although each agent adheres to strict tool permissions, the communication workflow overlooked enforcing necessary behavioral constraints, leading to potential data leaks. This investigation emphasizes the importance of enforcing transitive policies in AI frameworks, which dictate how permissions and data flow between agents should be controlled and monitored. The author proposes that the runtime must maintain these behavioral constraints throughout the delegation process, including authorization checks to prevent misuse of permissions. Existing models like CaMeL and Amazon's AgentCore illustrate components of this approach, but the call for a comprehensive system that integrates authorization, information-flow restrictions, and action history remains pressing. By addressing these vulnerabilities, the AI/ML community can enhance the security and integrity of multi-agent systems against misuse and unauthorized disclosures.