Delegation Chains, the Confused Deputy, and the Protocols You Actually Deploy
DataRobot, Thursday, July 16th, 2026
DataRobot explains how multi-agent delegation chains break identity and create confused-deputy authorization failures.
This post examines how identity must survive multiple hops in multi-agent systems and what happens when it does not.
Two token claims are central: sub, identifying the original requester, and act, identifying the current actor.
Flattening the chain by re-minting a single flat token causes over-granting of permissions and destroys the audit trail, producing the classic confused deputy problem. DataRobot argues the chain is preserved or destroyed at two specific protocol surfaces, Model Context Protocol for agent-to-tool calls and Agent-to-Agent for agent-to-agent calls.
Teams are advised to verify their deployed implementations actually nest tokens correctly, since standards support does not guarantee correct authorization in practice.