Enforce least-privilege authorization in multi-agent AI chains using Cedar

This article demonstrates how to enforce least-privilege authorization in multi-agent AI systems using Cedar policies and OAuth 2.0 to prevent unauthorized scope expansion across delegation chains.

• Three-layer Cedar policy model: agent-to-tool (L1), agent-to-agent delegation (L2), and originating user authorization (L3)
• HMAC-SHA256 signatures protect user context integrity across multi-hop delegation chains
• OAuth 2.0 Token Exchange (RFC 8693) limits delegation scope using on-behalf-of (OBO) pattern
• Reference implementation uses AWS Lambda, Amazon Verified Permissions, Amazon Cognito, and AWS WAF
• Layer 3 enforces originating user role and MFA verification for high-risk operations
• OCSF 99001 audit events logged to CloudWatch for compliance and monitoring
• Deployment via AWS CDK with five CloudFormation stacks and end-to-end test scenarios

The solution addresses OWASP ASI03 (Identity & Privilege Abuse) by maintaining authorization boundaries at every agent delegation hop while supporting multi-account scaling and human-in-the-loop escalation.