Agent Sub-delegation Passes Full Credentials. You Approved a Scoped Action.

Markdown library not available. Raw content:

Most agent frameworks pass the parent agent's credentials to sub-agents without modification. The scope your user approved for the parent silently becomes the scope every downstream agent operates under.

This is not a theoretical risk. It is the default behavior.

When you build an orchestrator that spawns execution agents, those sub-agents are typically initialized in the same runtime, with the same environment variables, the same tool registry, the same API key. The spawning mechanism does not issue a scoped token for "task 3: read document X and return summary." It hands the sub-agent whatever the parent had.

The sub-agent for task 3 can write to the database. It can trigger webhooks. Nothing about the invocation restricted it to read. The scope was described in the prompt, not enforced in the credential.

Prompt-scoped authorization is not authorization. It is instruction. The distinction matters when something goes wrong — or when a regulator asks you to prove it could not.

## What the EU AI Act requires

Article 9 of the EU AI Act requires high-risk AI systems to operate under a risk management system that identifies and controls risks "throughout its entire lifecycle." A delegation pattern that silently expands credential scope is a lifecycle risk. It must be identified, and the controls must be demonstrable — not asserted.

Article 17 requires documented technical measures ensuring the system functions as intended. If an agent is authorized to read a record and delegates that operation to a sub-agent carrying full read/write credentials, the technical measures have failed to constrain actual execution scope, regardless of whether the sub-agent chose to stay within bounds.

Neither article specifies the implementation. Both require that you can demonstrate the problem was solved — not that the system happened to behave correctly.

## How the gap opens in practice

Consider a planning agent that decomposes a task and spawns execution agents for each subtask