Authorization Propagation in Agent2Agent Systems: An Experimental Security Evaluation of Multi-Hop Delegation
Gabriele Donno, Kashif Mehmood, Katina Kralevska
Abstract
Delegated Agent2Agent (A2A) workflows create a security problem when the agent sending a request is different from the principal from which the authority originated. This paper evaluates a layered downstream-verification design in a synthetic four-party healthcare reimbursement workflow. The prototype separates current-caller context, transitive authorization evidence, per-hop Ed25519 request authentication, and independent replay state for requests and authorization artifacts. Of 15 adversarial conditions, 14 are rejected; an isolated delegation-path test exposes the absence of semantic authority attenuation. A separate authorized-intermediary experiment shows that a holder of the shared authorization-evidence HMAC key can modify the represented authority and generate valid evidence. In the fixed-depth local benchmark, the full configuration has a median security-processing latency of 5.11 ms and a 3.87 kB serialized payload. The results show the value of separating request authentication from inherited authority while identifying origin-verifiable delegation and semantic attenuation as requirements for stronger A2A authorization propagation.
Cite this entry
GB/T 7714-2015
Gabriele Donno, Kashif Mehmood, Katina Kralevska. Authorization Propagation in Agent2Agent Systems: An Experimental Security Evaluation of Multi-Hop Delegation[EB/OL]. arXiv preprint (cs.MA), 2026(2026-11-04)[2026-11-13]. https://arxiv.org/abs/2611.07050.
BibTeX
@misc{donno2026,
author = {Gabriele Donno and Kashif Mehmood and Katina Kralevska},
title = {Authorization Propagation in Agent2Agent Systems: An Experimental Security Evaluation of Multi-Hop Delegation},
year = {2026},
organization = {arXiv preprint (cs.MA)},
howpublished = {\url{https://arxiv.org/abs/2611.07050}},
} This entry is part of the AgentNet Observer library. Attribute with a link to this page when quoting.