What reading the field side by side showed us.

The evidence

Every delegation scheme we reviewed guarantees that a sub-agent can never hold more than the agent that started it. That is valuable, and it is easy to mistake for least privilege. It is not. Narrowing protects whatever the first agent was given, including everything it never needed. One study measured agents exposed to about fifteen times the tools their task required (Sidik & Rokach). A chain that never widens still carries that excess at every step.

Sidik & Rokach arXiv:2604.11839

The evidence

The danger in agent access is often a pair: reading customer records is fine, sending data outside is fine, both in one session is how data leaves. The leading system that checks combinations does so from a list of forbidden pairs, and its safety guarantee holds only "under a complete restriction set" (Muruaga, Bounded Agents). We show that the obvious alternative, one ceiling on the combined effect, cannot work at all: anything that fits under a ceiling alone also fits together. It takes a bound with several corners.

Muruaga, Bounded Agents arXiv:2608.15888

The evidence

Three recent works take incompatible positions without citing each other. One forbids any policy derived from model output, to keep out poisoning (Capability Gates). One lets the model propose short-lived permissions that a fixed checker approves (IntentCap). Others learn policy from observed behaviour, one of them in what it calls a controlled staging phase (AgentGuardian). The third position is the exposed one: an attacker who influences what is observed only needs to be seen, not to succeed.

Capability Gates arXiv:2606.28679IntentCap arXiv:2609.14631AgentGuardian arXiv:2601.10440

The evidence

Defences report attack results in detail and the cost to legitimate work thinly. One widely cited result of zero false denials rests on ten benign cases (Capability Gates). With no failures in ten trials, the true rate could still be as high as 30.8% at 95% confidence. The same work's result on 48 attack attempts bounds its miss rate far more tightly, at 7.4%.

Capability Gates arXiv:2606.28679

The evidence

Several systems put data on one scale. They are separate: how far to trust an instruction from an untrusted email is an integrity question; how far a customer record may travel is a confidentiality question. Information-flow work for agents keeps the two apart (FIDES), as access-control theory has since the 1970s.

FIDES arXiv:2505.23643