AI agents increasingly operate with credentials, memory, tool access, and the ability to delegate work to other agents. That creates a security problem traditional IAM was not designed to solve: an agent can be correctly authenticated and individually authorized while the overall execution chain produces authority that was never intended.

This session explores “ConfusedPilot” attacks — delegated-authority and confused-deputy failures across agents, tools, APIs, and MCP-style connectors.

Using representative agentic workflows and attack scenarios, I will show how authority can drift or escalate as tasks move across agent and tool boundaries, why static authorization and identity checks can miss these paths, and how defenders can model the effective authority available during execution.

The session will introduce a Runtime Authority Graph approach for tracing identity, delegation, tool invocation, and privilege propagation across an agentic workflow, and discuss practical controls for continuous authorization, dynamic least privilege, provenance, revocation, and runtime detection.

The goal is to move agent security beyond prompt injection toward a deeper question: not simply “Who is this agent?” but “What authority can this execution chain exercise right now, and why?”