SUDP: Secret-Use Delegation Protocol for Agentic Systems

arXiv cs.AI / 4/29/2026

💬 OpinionDeveloper Stack & InfrastructureIdeas & Deep AnalysisModels & Research

共有:

Key Points

The paper identifies a core security risk in agentic systems that use user secrets: bearer-secret interfaces can turn prompt injection or tool compromise into durable account compromise by exposing reusable authority.
It formalizes the “Agent Secret Use (ASU)” problem and provides a security taxonomy that distinguishes the structural requirements of safe secret-backed operations from robustness conditions needed in concrete designs.
The authors propose the Secret-Use Delegation Protocol (SUDP), a three-role protocol in which a requester proposes an operation, the user issues a fresh authenticator-backed single-use grant, and a custodian redeems it to perform bounded use without reusable authority crossing back to the requester.
They specialize SUDP for agentic deployments where agents propose operations but never directly retrieve secrets, and they argue—under explicit assumptions—that SUDP achieves verifiable authorization, operation-boundedness, and single-use properties.
The protocol is also analyzed for additional security goals such as storage confidentiality, key isolation across wrapping epochs, and plaintext-level forward secrecy that depends on secret rotation and revocation by the environment.

Abstract

Agentic systems increasingly act with user secrets for APIs, messaging platforms, and cloud services. Today's bearer-secret interfaces implement authorization by exposure: enabling action often means placing a reusable secret, or a reusable artifact derived from it, within a model-steerable boundary, so a transient prompt-injection or tool-side compromise becomes durable account compromise. Existing defenses cover adjacent pieces such as secret storage, scoped delegation, sender-constrained tokens, and runtime monitoring, but leave the combined agentic obligation without a common specification: an untrusted autonomous requester should be able to cause a user-authorized secret-backed operation without exposing reusable authority to the requester. We formalize this problem as Agent Secret Use (ASU). From ASU we derive a security-property taxonomy that separates the problem's structural obligations from the realization-level robustness conditions any concrete construction must establish, enabling principled comparison of existing agentic-secret defenses against a problem-grounded specification. We propose the Secret-Use Delegation Protocol (SUDP), a three-role protocol realizing ASU: a requester proposes a canonical operation; the user authorizes it with a fresh authenticator-backed grant; and a custodian redeems the grant once to perform the bounded use, so reusable authority never crosses the requester boundary. We specialize SUDP for agentic deployments: agents propose operations; they do not retrieve secrets. Under explicit assumptions, we show that SUDP satisfies the ASU requirements: authorization is verifiable, operation-bound, and single-use. SUDP also provides storage confidentiality and wrapping-epoch key isolation under stated sealing and erasure assumptions; plaintext-level forward secrecy of the underlying secret additionally requires the environment to rotate and revoke it.