•11 min
The Agent Can Call the Tool. That Is Not the Same as Allowed.
An agent that holds a tool runs it with the whole application's credentials, not the current user's. That gap is the confused deputy problem, and it is how a support agent ends up refunding an order the user was never allowed to touch. The fix is a fail-closed authorization check on every side-effectful call.
LLM
Agents