The confused deputy problem, named in 1988, is when a privileged program is tricked into misusing its authority on behalf of an attacker. An agent with ambient access to your tools, credentials, and data is the most persuasive deputy ever confused — and ambient authority is the reason why.

The classic pattern: an agent holds standing access — the same API keys, the same filesystem, the same database role — regardless of what task it is doing. Any successful manipulation (see: prompt injection) inherits all of that authority instantly. The failure is not that the agent was malicious; it is that nothing stood between the request and the privilege. The remedy is to make authority narrow, temporary, and earned: capability tokens instead of ambient identity. The agent receives, per task, an unforgeable grant — scoped to specific resources and actions, expiring, and optionally single-use — exactly like a capabilities-based OS or an object-capability language. No grant, no access; the injection that succeeds still has nothing to invoke.

The supporting practices complete the fence. Per-task service identities: the agent's credentials differ by task class, so a research task literally cannot call the deploy API. Short TTLs: a stolen capability dies before it is useful. Delegation chains: when agents spawn agents, each child's grant is a subset of the parent's — authority only ever narrows. Audited invocation: every capability use logs token ID, resource, and action, so "who could have done this" has a database answer instead of a meeting.

Migration Path

• Inventory ambient authority: list what the agent can reach today with its standing credentials; that list is the risk register.
• Split the key ring: one service identity per task class before full capability infrastructure — the 80% win is embarrassingly cheap.
• Gate the crest: the two or three irreversible actions get human-in-the-loop or hardware-backed approval regardless of what the agent holds.
• Test the negative path: red-team the grants — the passing test is the injection that cannot act, not the agent that resists politely.

The pattern's provenance is the reassurance: confused deputies have been a solved-class problem in security engineering for decades, with a known cure — stop delegating identity, start delegating capability. Agents did not invent the disease; they just made every untreated case conversational.