Access Controlled Website Interaction for Agentic AI with Delegated Critical Tasks

1. Problem Statement

Recent advancements in Agentic AI allow autonomous systems to perform complex, critical tasks (e.g., e-commerce transactions, healthcare management, algorithmic trading) on behalf of users. However, current web infrastructure lacks robust mechanisms to securely delegate these tasks to AI agents.

• Security Gaps: Existing websites are not designed for agent interaction, leading to risks such as unauthorized purchases, identity theft, and data exposure.
• Lack of Standardization: Current e-commerce platforms do not support user-defined constraints, automated logins without human intervention, or fine-grained delegation of transactional authority.
• Limitations of Existing Solutions: While some financial providers (e.g., Mastercard) offer tokenization for payments, these are ecosystem-specific and lack a generalized framework for broad website interactions.

2. Methodology

The authors propose an open-source software architecture that integrates a modified authorization service with a custom website design to enable secure, fine-grained access control for AI agents.

A. System Architecture

The system involves four key entities:

1. Human User: The principal who delegates authority.
2. AI Agent: The autonomous actor performing tasks.
3. Website: The target service requiring access control.
4. Auth (Secure Swarm Toolkit - SST): A decentralized, open-source authorization service acting as a Key Distribution Center (KDC).

B. Core Technical Components

1. Extended Authorization Service (Auth)
The authors modified the open-source Secure Swarm Toolkit (SST) to support access delegation. Key database extensions include:

• Registered Entity Table: Stores credentials and group memberships (e.g., Users, High/Medium/Low Trust Agents, Websites).
• Communication Policy Table: Defines access rules. A new "Delegation" target type was introduced, allowing a requesting group (e.g., Users) to delegate access to a target group (e.g., Websites) via an intermediate group (e.g., Agents). It specifies crypto specs, validity periods (absolute and relative), and maximum owners.
• Cached Session Key Table: Stores cryptographic session keys as tokens. A new column, ExpectedOwnerGroups, ensures that session keys are only issued to agents belonging to the authorized trust groups defined in the policy.

2. Secure Access Delegation Workflow

• Delegation: The user requests Auth to create a session key for a specific agent, defining the agent's trust level and scope.
• Key Issuance: Auth validates the request against the Communication Policy, generates a session key, and stores it in the Cached Session Key table with the agent's group as the expected owner.
• Agent Retrieval: The agent requests the key using a Session Key ID. Auth verifies the agent belongs to the ExpectedOwnerGroups and that the key hasn't been issued to another owner (preventing duplication).

3. Website Design & Authentication Protocol
The website (built with React and Python Flask) enforces policies through a challenge-response mechanism:

• Login Challenge: The website generates a 32-digit random nonce.
• HMAC Verification: The agent computes a Keyed-Hash Message Authentication Code (HMAC) using the nonce and its session key. It submits the Session Key ID and the HMAC.
• Validation: The website retrieves the session key from Auth, recalculates the HMAC, and verifies it matches the agent's submission.
• Policy Enforcement: Upon successful authentication, the website checks the agent's group and the session's relative validity period. It strictly enforces user-configured scopes (e.g., allowing access to email but denying access to phone numbers).

3. Key Contributions

1. Authorization Extension: An extension of the SST Auth toolkit to support secure, fine-grained access delegation for AI agents via cryptographic tokens and policy-driven session keys.
2. Agent-Aware Website Design: A novel website interface and backend workflow that allows human users to define granular access scopes for agents and enables agents to perform critical tasks (like mock purchases) securely.
3. Open-Source Implementation: Full release of the design, source code (frontend/backend), agent scripts, and experimental logs on GitHub.
4. Evaluation Framework: A comprehensive validation of the system's security and performance.

4. Results & Evaluation

The system was evaluated using an OpenAI gpt-oss-20b model for agent reasoning, deployed on the ASU Sol Supercomputer.

• Authentication Correctness: Achieved 100% success for valid agents with correct keys and 0% success for invalid keys.
• Fine-Grained Access Control: Successfully enforced scope limits. Low-trust agents were allowed to retrieve non-sensitive data (email) but were blocked (HTTP 403) from accessing sensitive data (phone/address).
• Unauthorized Access Handling:
  • Requests from agents outside ExpectedOwnerGroups were rejected 100%.
  • Repeated requests for the same session key were rejected 100% to prevent duplication.
• Session Management: Sessions automatically terminated after the relative validity period expired, preventing reuse.
• Latency Analysis:
  • Successful delegated access took 127–140ms (average).
  • Unauthorized requests were rejected faster (~98ms) as the system terminated the process early.
  • Latency variations were attributed to LLM inference times rather than trust levels.

5. Significance

• Decentralized Security: By leveraging SST, the system operates independently of third-party cloud infrastructure, allowing entities (households, companies, hospitals) to manage their own delegation policies locally.
• Scalability to Autonomous Delegation: The framework is not limited to AI; it supports any human-to-entity or entity-to-entity delegation scenario, providing a blueprint for the "Agentic Web."
• Bridging the Gap: It addresses the critical lack of standardized, secure interaction models between autonomous AI agents and existing web services, mitigating risks associated with the rapid adoption of agentic AI in critical domains.
• Future Work: The authors identify formal verification (e.g., using Alloy) as a next step to mathematically guarantee the absence of authorization violations across all execution paths.