Plugins Are Capability Grants, Not Modules: Ambient Authority Is Why A Prompt Injection Works

Summary

Ambient authority — components exercising authority they simply have, rather than authority explicitly granted — is the documented root cause of prompt injection: the attacker asks the deputy to use authority it already holds. A capability is an unforgeable reference to a resource together with permissions over it, granted explicitly; organised by authority rather than by code, plugins become a security boundary. Capabilities should attenuate but never expand, so delegation narrows by construction — and you can instrument every grant before you enforce, turning migration into measurement.

Key concepts

• Ambient authority — what 'acting as you' means in practice — the root cause the shared-drives research found live everywhere
• Capabilities attenuate, never expand — delegation narrows by construction — the same discipline the registry rules carry
• Instrument before enforcing — recording every grant is the Enumerated step; enforcement follows measurement

Key ideas

• The reference is the permission: pass handles, not names.
• A plugin must not adjudicate its own authority — the kernel grants, the plugin implements.
• Sequence and capability address the same problem from two directions, and neither is sufficient alone.

On this site

Curated under 'what is an agent actually allowed to do?' in the collection; the root-cause frame behind the thesis's evidence.

Infographic

Read the document