The confused deputy problem occurs when a component with legitimate authority is induced to use that authority for a requester who lacks permission. Checking that a dashboard, service, or agent may call a protected system is not enough; the decision must also ask whether the initiating principal may cause that action on the requested resource. section 11.1.1 section 18.2
Salary dashboard: authorize Carol, not just the dashboard
A Manager Dashboard can call an HR API, but an employee must not gain salary access merely by reaching that dashboard. A gateway can evaluate Carol as the principal, the salary-view operation as the action, the requested department as the resource, and the dashboard as context. It allows a manager's own department and blocks another department before the HR API receives the call. section 11.1.1
Preserve the authority behind every request. Delegation, tenant, time limit, resource, task, and initiating identity may all determine whether an intermediary is acting within the authority actually granted. A service identity establishes which workload made a call, but it does not by itself establish who may benefit from that call. section 13.6.2 section 11.1.2
Useful enforcement patterns include:
- At an API gateway, normalize the request into principal, action, resource, and context (PARC) before forwarding it to the protected API. section 11.1.1
- For support escalation, use a short-lived credential restricted to the approved tenant and time window, then evaluate the engineer under that delegated authority. section 13.6.2
- In a service mesh, carry the acting-on-behalf-of relationship alongside workload identity so each proxy can evaluate the full request context. section 11.1.2
- For AI agents, authorize each tool invocation using the agent, target, task, delegation, initiating principal, tenant, and runtime constraints rather than the agent's capabilities alone. section 18.2
Figure 11.1 API Gateway as a centralized enforcement point. Carol’s request moves through the Manager Dashboard to the HR API. The API Gateway functions as the PEP, forwarding a normalized PARC request to the Cedar engine (PDP). The HR API receives the call only if Cedar returns an allow decision.
This request path shows a centralized enforcement point deciding on Carol's authority before the HR API is called. section 11.1.1
This failure is especially consequential for capable intermediaries. An AI agent can select tools, combine actions, retry strategies, and delegate to subagents; access to a file system, customer database, payment API, or workflow engine does not authorize every instruction that reaches it. Enforcing policy at each tool or command invocation keeps authority tied to the actual request. section 18.2
