Why it matters

Confused deputy is fundamental pattern. Understanding shapes secure design.

Advertisement

The architecture

Attacker requests action.

Agent has privileges.

Agent performs attacker action.

Confused deputy flowAttacker requestinnocuous-lookingAgent usesown privilegesAttacker outcomeimpersonationDistinguish user auth from agent auth; verify user intent for privileged ops
Confused deputy.
Advertisement

How it works end to end

Preserve user identity in tool calls.

Delegated tokens with user scope.

Verify intent for privileged ops.