AWS’s public sector team has written the clearest security framing for agents I have read from a cloud vendor. In Controlling delegation in agentic AI with Amazon Bedrock Agent Core, Brigette Bucke and Marc Cressall open with the thesis: “Prompt injection, excessive agency, and information disclosure are distinct risk categories in agentic AI, but they share an underlying condition: uncontrolled delegation.” Trust is delegated at the input, action is delegated to tools, and access is delegated to the data layer, and the three familiar failures are the three places a handoff happens without a check. The diagnostic is one question: “At each crossing, ask the question, ‘What is the boundary check?’ If the answer is ‘the model decides,’ that’s uncontrolled delegation.”
There are no benchmark figures, only a scenario and a test, and both travel. The scenario is a procurement agent summarizing vendor responses, where “one vendor buries a single sentence on page 47 of their 80-page response” instructing the agent to recommend immediate approval, and the attack works because it is “valid text, such as a normal paragraph buried on page 47 of a vendor PDF.” For the audience the blog serves, the stakes are stated without hedging: “A single crafted message to a benefits eligibility agent could override its instructions, trigger an unauthorized database query, and surface another applicant’s personal information.” The test takes five minutes: plant an instruction in the knowledge base, ask a normal question, and see whether the agent follows the planted line. The prescription is “defense in depth,” treating “everything from the retrieval layer as untrusted data, not instructions.”
The catalog can hold the post’s own vocabulary against the platform it is written on. The Amazon Bedrock provider page lists 8 API pages, and the agent surface the post describes runs on the Amazon Bedrock Agent API and the Amazon Bedrock Agent Runtime API. AgentCore itself, named in the title, still has no API page under the record, which this series has now noted three times. The agentic access profile maps 12 operations, 6 of them acting.
The Kin Score is 55.0, strong band, carried by access clarity at 79.5 and discoverability at 66.1, with contract quality at 57.8 and contract governance at 23.5. The Agent Readiness score is 23.0, agent-aware, and the unlit list is the post’s argument turned into a scorecard. Delegated identity is unlit. Consent identity is unlit. Protected resource metadata and dynamic client registration are unlit, and so are dry-run mode and reversibility. A post about controlling delegation is published on a platform whose public record describes no way for an agent to act under a delegated, attributable grant, and no way to rehearse an action before it runs. The boundary check the authors ask for is exactly what those dimensions measure. On Bedrock’s own record, the answer to their question is still “the model decides.”