IAM para Agentes: Delegação com Tokens & Prevenção de Confused Deputy
Autonomous AI agents with tool calling capabilities act as privileged intermediaries between users and backends. We demonstrate how an unprivileged user can leverage prompt persuasion and multi-step reasoning manipulation to turn the agent into a confused deputy that modifies restricted database records.
A Vulnerabilidade de Confused Deputy
An enterprise internal assistant has access to both read-only company docs and a database modification tool reserved for DevOps. A standard employee tricks the agent into modifying cluster firewall rules.
Blueprint Arquitetural de Delegação Hardened
Aplique validação de token duplo em cada chamada de ferramenta. O dispatcher precisa validar tanto a identidade da máquina quanto o JWT do usuário humano:
interface UserContext {
userId: string;
roles: string[];
token: string;
}
// Scoped Tool Dispatcher enforcing User-Level Authorization Tokens
export async function executeAgentTool(
toolName: string,
params: Record<string, unknown>,
user: UserContext
) {
// 1. Verify user RBAC permissions for the target tool
const isAuthorized = await checkUserPermission(user.userId, toolName);
if (!isAuthorized) {
throw new Error(`Security Error: User ${user.userId} is not authorized to invoke tool ${toolName}`);
}
// 2. High-risk tool confirmation gate (HITL)
if (isHighRiskTool(toolName)) {
return await requestHumanInTheLoopConfirmation(user.userId, toolName, params);
}
// 3. Execute tool using user-scoped token (not global service account)
return await dispatchToBackend(toolName, params, { authorization: `Bearer ${user.token}` });
}Precisa de uma Auditoria de Identidade & Acesso em IA?
A Navira Security audita catálogos de identidade de agentes, grafos de privilégios e portões de aprovação humana.