In the modern digital workplace, a new kind of worker has emerged: the software agent. These are programs powered by large language models that can read documents, send emails, move data between systems, and even call other programs to get things done. They act on behalf of human employees, taking instructions and turning them into a series of actions. The promise is immense efficiency, but the risk is equally high. If a human employee is tricked into sending a secret file to the wrong person, the damage is contained to that one person's judgment. But when a software agent is tricked, it can execute that mistake with perfect speed and across every system it is allowed to touch. The core challenge for security experts is not just making these agents smarter so they do not get tricked, but building a system where it does not matter if they are tricked, because the damage is physically impossible to perform.

This is the central problem addressed in a new study by independent researcher Xabier Muruaga, who proposes a way to secure these digital workers not by trying to make the brain of the agent more robust, but by tightening the rules of what the agent is allowed to do. The research argues that the danger of a software agent being manipulated is primarily a problem of permission architecture, not a problem of the artificial intelligence model itself. Even if an agent is perfectly secure against trickery, it can still cause harm if it is given too much freedom to combine harmless actions into a dangerous outcome. For example, an agent might be allowed to read a confidential document and allowed to send an email. Individually, both actions are safe. But if the agent is tricked into reading the document and then immediately emailing it to an outside address, the combination creates a data breach that neither permission alone intended to allow.

To solve this, Muruaga developed a system called the Agentic Principal Chain. Imagine a chain of command where a human boss delegates a task to a manager, who then passes a piece of that task to a junior assistant. In traditional security systems, once the boss gives permission, that permission travels down the chain without changing. The junior assistant might end up with the same broad powers as the boss, creating a huge risk if that assistant is compromised. The Agentic Principal Chain changes this by ensuring that with every step down the chain, the permission gets smaller and more specific. It acts like a strict gatekeeper that sits outside the agent's thinking process. Before the agent can perform any action, this gatekeeper checks not just if the agent has the right to do that specific thing, but also what the agent has done in the past during this same session.

The system works by tracking a "session state," which is a running log of every action the agent has taken. If an agent is authorized to read a file and authorized to send an email, the system looks at the history. If the agent just read a secret file, the system will block the next attempt to send an email, even if sending emails is generally allowed. This prevents the agent from combining two safe actions into a dangerous one. The researchers call this "composition closure." It is a rule that says certain combinations of actions are forbidden, regardless of whether the individual steps are allowed. The system also limits the "blast radius" of any single agent. If a sub-agent is compromised, the damage it can cause is mathematically bounded by the permissions it inherited, which are strictly smaller than the permissions of the agent that created it. This ensures that a breach in one part of the system cannot spiral out of control to destroy the entire organization.

To test if this approach actually works, the researchers built a working version of the system and put it through a series of rigorous trials. They tested it against thousands of simulated attacks using established security benchmarks. In one set of tests involving over 1,000 scenarios designed to steal data, the system blocked every single attempt. In another set of tests where the researchers simulated a situation where the artificial intelligence model itself was completely compromised and fully under the control of an attacker, the system still stopped the attacks. When the model tried to send stolen data, the gatekeeper denied the request because the combination of actions violated the session rules. The system also successfully prevented the agent from destroying files or manipulating data in ways that were not part of the original task, reducing the success rate of such attacks from over 90 percent down to just 12 percent.

The study also measured how much this extra layer of security slowed the agents down. The results showed that the system is incredibly fast, adding less than a quarter of a millisecond to the time it takes to make a decision. This means that the security checks happen almost instantly, without noticeable delay for the user. However, the researchers found that there is a trade-off. In some cases, the strict rules prevented the agent from completing a legitimate task because the system was too cautious about the combination of actions. In their tests, the success rate of legitimate tasks dropped by about 8.6 percentage points when the strictest rules were applied. This suggests that while the system is highly effective at stopping attacks, it requires careful tuning to ensure it does not become so restrictive that it hinders normal work.

The researchers were careful to define what their system does and does not do. They proved mathematically that if the rules are set up correctly, it is impossible for an agent to perform a prohibited combination of actions. They also proved that the potential damage from a compromised agent cannot grow larger as the task is passed down the chain of command. However, they noted that their system does not fix every possible problem. It cannot stop an agent from doing something harmful if that single action is already allowed by the rules, such as deleting a file if the agent has permission to delete files. It also cannot stop an agent from being tricked into making a poor choice within its allowed scope. These issues require different solutions, such as better training for the artificial intelligence or more detailed checks on the specific data being handled.

Ultimately, the paper presents a shift in how we think about securing artificial intelligence. Instead of trying to build an unbreakable mind, the focus moves to building an unbreakable cage. By enforcing strict rules about what actions can be combined and ensuring that permissions shrink as tasks are delegated, the system creates a safety net that holds even when the agent's judgment fails. The research demonstrates that with the right architectural controls, we can allow these powerful digital workers to operate in complex environments without fear that a single moment of confusion will lead to catastrophe. The findings suggest that the path to safe artificial intelligence lies not just in smarter models, but in smarter systems that know how to say no, even when the model says yes.