💻 computer science

Verifiable Delegated Authority for LLM Agents in Banking: A Formal Architecture, Capability Protocol, and Audit Guarantees

This paper proposes a formal architecture for secure LLM agents in banking that decouples authorization from the model using attenuated capability tokens and deterministic policy engines, providing provable guarantees for authority containment, bounded financial loss, and audit integrity against adversarial actors.

Original authors: Neeraj Aggarwal

Published 2026-10-20

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Neeraj Aggarwal

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the high-stakes world of banking, trust has traditionally been built on rigid rules and predictable actors. For decades, banks have secured their digital doors by ensuring that every action comes from a known human or a reliable, pre-programmed computer service. These systems operate on a simple premise: if a request is signed by the right person and follows the right steps, it is safe to execute. However, a new kind of worker has entered the scene: the artificial intelligence agent. Unlike a human or a standard computer program, these agents are powered by large language models that can reason through complex, unstructured information like emails or reports. They can decide on their own which steps to take next. This flexibility makes them incredibly useful for handling messy back-office tasks, but it also introduces a profound uncertainty. Because these agents do not always make the same decision twice, even when given the same information, the old security models that assume a predictable actor no longer hold up. If an AI agent is given the keys to move money, how can a bank be sure it won't accidentally or maliciously transfer funds it shouldn't?

Neeraj Aggarwal, a researcher at Infosys, addresses this exact problem with a new framework designed specifically for banking. The core idea is to stop trying to make the AI itself perfectly safe and instead build a secure cage around it. In this new architecture, the AI is treated not as a trusted decision-maker, but as an untrusted proposer. It is allowed to suggest actions, but it is never allowed to execute them directly. Instead, every suggestion must pass through a separate, deterministic policy engine that acts as a strict gatekeeper. This engine checks the suggestion against a set of rules and a specific "capability token" that limits exactly what the agent can do, how much money it can move, and for how long. The system is designed so that even if the AI is tricked by a malicious prompt or confused by bad data, it cannot break out of its assigned boundaries. The researchers prove mathematically that under this design, the agent can never escalate its own privileges to do something it wasn't authorized to do, and they calculate a precise upper limit on how much money could be lost if the system is attacked without human intervention.

To ensure that everything happened correctly, the researchers also built a system of verifiable evidence. Every single step the agent takes, from the initial idea to the final execution, is recorded in a secure, unchangeable log that is signed and linked together like a chain. This allows an auditor, or even another computer, to look at the record months later and verify that the agent stayed within its rules, without needing to see the AI's internal thought process or re-run the AI itself. The system also introduces a method for using multiple AI agents to review each other's work. The researchers found that simply adding more reviewers does not guarantee safety; instead, the key is having reviewers that are diverse, meaning they are built on different models or trained differently. If all the reviewers share the same blind spot, they will all make the same mistake. By quantifying this risk, the system can decide when a second opinion is actually worth the cost and when it is necessary to stop and ask a human for help.

The team tested these ideas by building a working prototype and running it through thousands of simulated attacks. In these tests, an adversarial computer—acting as a stand-in for a malicious agent, with no real language model in the loop—tried to trick the system into performing unauthorized actions, such as forging tokens, replaying old commands, or tampering with the logs. Across 700,000 attempts, the system successfully blocked every unauthorized execution. The simulations, which relied on synthetic data and used HMAC-SHA256 to stand in for real digital signatures, confirmed that the mathematical limits on financial loss were accurate; when the attackers tried to push the system to its absolute limit, the losses matched the predicted maximum exactly, proving the safety net was tight. The tests also revealed two specific weaknesses in the initial design: one related to how long tokens remained valid and another regarding the ability to roll back logs to an earlier state. The final design closed these gaps, ensuring that even if an attacker managed to steal a token, it could only be used once and only within a very short time window.

This approach represents a shift in how we think about securing intelligent systems in critical infrastructure. Rather than hoping the AI will always behave, the system assumes it might not and builds a layer of enforcement that is separate from the AI's reasoning. The result is a workflow where the AI can do its job of sorting through complex information and proposing solutions, while the bank retains absolute control over the final action. The researchers demonstrated that it is possible to have powerful, automated agents in a banking environment without creating an un-auditable risk. By treating the AI as a proposer and the execution layer as the enforcer, and by keeping a tamper-proof record of every decision, banks can begin to use these tools with a level of safety and accountability that was previously impossible. The work remains a formal model and a simulation, but it provides a clear, proven path for moving AI agents from experimental tools into the core of regulated financial operations.

Technical Summary: Verifiable Delegated Authority for LLM Agents in Banking

1. Problem Statement

The integration of Large Language Model (LLM) agents into banking infrastructure introduces a fundamental security gap. Traditional API security models rely on a stable actor assumption: either a human in an authenticated session or a deterministic service calling a versioned API. LLM agents violate both assumptions by reading unstructured context, reasoning non-deterministically, and selecting action sequences that may vary across runs.

When connected to systems that move money, this non-determinism creates significant risk. Existing safety research often focuses on prompt injection detection or filtering at the model level. However, the author argues that for regulated banking, the enforcement of authority must be moved out of the model and into the execution boundary. The core challenge is to provide formal guarantees that an agent, acting as an untrusted stochastic proposer, cannot exceed its delegated authority, while ensuring that a third party (auditor or regulator) can verify compliance without trusting the agent's self-report or accessing the model's weights.

2. Methodology and System Architecture

The paper proposes a formal architecture where the LLM is treated strictly as an untrusted proposer of typed actions, while a deterministic policy engine and execution layer enforce all authority.

Core Components

Formal Model of Authority:
- Actions: Defined as typed actions with parameter spaces (e.g., amount, currency) and associated loss exposure.
- Delegation Chains: Authority is represented as a chain of grants that attenuate (reduce) over time. A valid chain ensures that no agent can escalate privileges; the effective authority of any agent is a subset of the root principal's grant.
- Trusted Computing Base (TCB): Includes the policy engine, execution layer, append-only log, and identity infrastructure. The LLM is explicitly excluded from the TCB.
Protocol of Signed Intent Envelopes and Tokens:
- Intent Envelopes: Proposed actions are wrapped in signed envelopes containing the action, agent identity, delegation chain, and business case.
- Capability Tokens: Upon policy approval, the engine mints a single-use, parameter-bounded token. Crucially, the token's validity window ( $t_{exp}$ ) is strictly bounded by the expiry of the underlying delegation chain.
- Execution Check: The execution layer verifies the token signature, checks that the action matches the token's type and parameter bounds, ensures the token is within its time window, and verifies the identifier has not been spent.
Verifiable Workflow:
- Every state transition emits a signed event to an append-only, hash-chained log.
- An evidence-only verifier can validate the entire workflow using only the log, public keys, and policy versions, without replaying the LLM.
Multi-Agent Consensus:
- For high-risk intents, a second, independently configured reviewer agent is introduced.
- The paper models "common-cause" failures (e.g., shared training blind spots) to demonstrate that reviewer diversity (different model families/prompts) is more critical than reviewer count for reducing residual risk.

3. Key Contributions

The paper provides five specific theoretical and practical contributions:

Formal Model: A definition of delegated authority for LLM agents in banking, featuring typed financial actions, attenuating delegation chains, and a deterministic Attribute-Based Access Control (ABAC) policy engine with a human-approval lifecycle.
Authorization Protocol & Proofs:
- Theorem 1 (Authority Containment): Proves that under an arbitrary adversarial proposer, every executed action is contained within the effective authority of a valid delegation chain, provided the policy engine and signature schemes are secure.
- Theorem 2 (Bounded Unattended Loss): Derives a closed-form upper bound on financial loss for actions executed without human approval, based on per-type caps and sliding-window rate limits.
Multi-Agent Consensus Analysis:
- Proposition 1: Quantifies the residual risk of consensus, showing that adding reviewers yields diminishing returns unless the "common-cause" failure probability ( $\gamma$ ) is reduced via diversity.
- Proposition 2: Establishes a cost-aware rule for invoking human or agent review based on the probability of harm and the cost of review.
Verifiable Workflow Definition:
- Theorem 3 (Tamper Evidence): Proves that a log with a signed head and an independent witness (to prevent rollback attacks) ensures that any accepted evidence sequence agrees with the genuine log.
- Theorem 4 (Soundness): Demonstrates that an evidence-only verifier can soundly certify that executed actions were authorized and within bounds, without access to the model.
- Proposition 3: Provides a sample-complexity bound for detecting policy drift when model versions change.
Reference Implementation & Simulation:
- A Python implementation tested against an adversarial proposer (no LLM in the loop) to validate containment, loss bounds, and tamper evidence.

4. Results

The reference implementation and simulation yielded the following results:

Containment: In 700,000 attempts by an adversarial proposer (covering nine attack classes including forged tokens, replay, and parameter tampering), there were zero unauthorized executions that violated the containment theorems.
Loss Bound Tightness: An adversary saturating the rate limit achieved maximum exposures that exactly matched the theoretical bound of Theorem 2, confirming the bound is tight.
Protocol Gaps Identified: The simulation exposed two critical gaps in initial designs:
1. Token Expiry: Without the rule $t_{exp} \le t_k$ (token expiry $\le$ chain expiry), 12,383 out of 20,000 attempts executed after the delegating grant had expired.
2. Log Rollback: Without an independent witness check, an attacker could successfully rollback the log to an older signed head; with the witness check, detection was 100%.
Performance: The enforcement pipeline (envelope check, policy, token minting, execution, logging) incurred a median overhead of 45 microseconds per action, suggesting enforcement cost is not a bottleneck.
Consensus Modeling: Monte Carlo simulations of the common-cause model matched the analytical predictions of Proposition 1 within error margins.

5. Significance and Claims

The author positions this work as a formal treatment tailored specifically for regulated banking, distinguishing it from general multi-agent safety research.

Shift in Trust Boundary: The paper claims that by moving enforcement to the execution boundary and treating the LLM as an untrusted proposer, banks can achieve provable authority containment and quantifiable loss bounds that do not depend on the model's reasoning or alignment.
Auditability: A significant claim is the ability for third parties (auditors/regulators) to verify compliance via an evidence-only verifier. This allows for auditability without requiring access to the proprietary model or its weights.
Quantitative Risk Management: The work provides a quantitative framework for multi-agent review, arguing that diversity of reviewers is the primary lever for reducing residual risk, rather than simply increasing the number of reviewers.
Modesty on Scope: The author explicitly states that the results assume the LLM acts within an enforced boundary. They do not claim to solve the problem of prompt injection harmlessly steering an agent toward permitted but undesirable actions (e.g., resubmitting a wrong payment within limits), though they note that consensus reduces the likelihood of such events. They also acknowledge that the proofs are "pen-and-paper" and not mechanized, and that the simulation uses synthetic data without real LLMs in the loop, leaving real-world injection resistance and utility evaluation as future work.

In conclusion, the paper argues that without such a formal architecture, integrating agents into core banking infrastructure creates a "largely unaudited attack surface." With this architecture, institutions can extend agentic automation into back-office workflows with formal guarantees of containment and verifiability.