---
source_url: "https://arxiv.org/abs/2509.13597?utm_source=openai"
title: "[2509.13597] Agentic JWT: A Secure Delegation Protocol for Autonomous AI Agents"
mirrored_at: 2026-08-05T01:00:59.052Z
host: arxiv.org
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/arxiv.org/abs/2509.13597__q__utm_source_openai"
---

> **Original source:** https://arxiv.org/abs/2509.13597?utm_source=openai

[View PDF](https://arxiv.org/pdf/2509.13597) [HTML (experimental)](https://arxiv.org/html/2509.13597v1)

> Abstract:Autonomous LLM agents can issue thousands of API calls per hour without human oversight. OAuth 2.0 assumes deterministic clients, but in agentic settings stochastic reasoning, prompt injection, or multi-agent orchestration can silently expand privileges.  
> We introduce Agentic JWT (A-JWT), a dual-faceted intent token that binds each agent's action to verifiable user intent and, optionally, to a specific workflow step. A-JWT carries an agent's identity as a one-way checksum hash derived from its prompt, tools and configuration, and a chained delegation assertion to prove which downstream agent may execute a given task, and per-agent proof-of-possession keys to prevent replay and in-process impersonation. We define a new authorization mechanism and add a lightweight client shim library that self-verifies code at run time, mints intent tokens, tracks workflow steps and derives keys, thus enabling secure agent identity and separation even within a single process.  
> We illustrate a comprehensive threat model for agentic applications, implement a Python proof-of-concept and show functional blocking of scope-violating requests, replay, impersonation, and prompt-injection pathways with sub-millisecond overhead on commodity hardware. The design aligns with ongoing OAuth agent discussions and offers a drop-in path toward zero-trust guarantees for agentic applications. A comprehensive performance and security evaluation with experimental results will appear in our forthcoming journal publication

Comments:

17 pages, 6 figures, 2 Tables

Subjects:

Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)

Cite as:

[arXiv:2509.13597](https://arxiv.org/abs/2509.13597) \[cs.CR\]

 

(or [arXiv:2509.13597v1](https://arxiv.org/abs/2509.13597v1) \[cs.CR\] for this version)

 

[https://doi.org/10.48550/arXiv.2509.13597](https://doi.org/10.48550/arXiv.2509.13597)

arXiv-issued DOI via DataCite

## Submission history

From: Abhishek Goswami \[[view email](https://arxiv.org/show-email/c6ef9d93/2509.13597)\]  
**\[v1\]** Tue, 16 Sep 2025 23:43:24 UTC (866 KB)