Who Is the Agent Acting As? Why AI Agents Become Confused Deputies

The article explains that AI agents given a single broad service account act with the platform's authority rather than the user's, so a prompt injection buried in a support ticket can produce a fully authorized write to another tenant's data. It recommends authorizing every tool call as the intersection of user, agent, and tenant permissions, decided in a gateway outside the model that fails closed and logs each decision.