Explain the confused-deputy problem in access control, give two examples from different layers of a system, and say what structurally prevents it rather than what patches each instance.

## The shape of the problem A confused deputy is a component tricked into misusing its own authority on behalf of someone who does not have it. It is not an authentication failure - everyone involved may be correctly identified - and it is not a missing check in the ordinary sense; the check often passes, because it is asked about the deputy rather than about the requester. The root cause is **ambient authority**: power attached to an identity, a connection or an environment, applied automatically to whatever action is performed, with no link to who requested it. ## Examples across layers - **The browser.** A page on one site causes a request to another, and the browser attaches the credentials it stores for the destination. The destination sees a properly authenticated request. The deputy is the browser; the authority is ambient because it is applied by destination rather than by intent. - **A server fetching a supplied address.** The application retrieves a resource named by the user, from inside a network where reachability itself is the privilege. The credential here is the deputy's position, which is why identity checks do not help. - **A background or scheduled worker.** A job queued 'on behalf of' a user executes later under the worker's service account, typically broad. If the queued payload names the resource but not the principal, the worker performs the user's request with the worker's rights. - **A service accepting any validly issued token.** A credential minted for one service is replayed to another that verifies integrity but not intended audience. The second service acts with its own authority on a request never addressed to it. - **A support impersonation feature.** Staff act as a customer; if the resulting actions carry staff authority rather than the customer's scope, the feature is a deputy by design. ## Why per-instance fixes are not the answer Each example has a known local patch - a request-origin token, an address allow-list, a principal field on the queue message, an audience check. Every one is correct and worth doing, and every one protects exactly one deputy. New deputies appear whenever a component starts doing work for others, so a defence that must be re-derived per deputy will lag the architecture permanently. ## The structural principle Replace ambient authority with **designation and authority carried together**. The request hands the deputy both what to act on and the right to act on it: a short-lived credential naming the original principal, stating the intended audience, and scoped to the specific action. Then the deputy cannot exceed what it was given, because it has no relevant authority of its own to be confused into using. Practically: propagate the caller's principal through every hop instead of re-asserting identity at each boundary; scope and audience-bind every credential so replaying it elsewhere fails; and reduce each deputy's standing privilege to the minimum needed for work nobody delegated. Rank the defences the usual way, from guarantee to heuristic: **structural separation** first - the deputy holds no ambient authority, so the failure is unrepresentable; then **enumerated, code-owned scoping** - audience checks and explicit principal propagation on every hop, finite and owned by your code; then **per-call validation** such as allow-listing a destination, which is open-world and only as good as the list; then **detection** - auditing what a service account actually did and alerting when privilege outruns the request that caused it. An allow-list sits below enumeration for the reason that always applies: it constrains a value while still admitting everything that matches, whereas an enumerated map of permitted targets is finite and owned by the code. ## The rule to state Authorization must be evaluated against the principal on whose behalf the action is taken, and that principal must be propagated rather than re-asserted by the deputy. Any place where a component's own rights exceed the rights of the party it is serving is a confused deputy waiting for input.