If every step an AI agent takes is individually permitted, why can the harm still slip through in the total?

This explores why least privilege, the rule of giving each agent only the permissions its step needs, can't stop harm that appears only when many allowed steps add up. The corpus never discusses least privilege by name, but several notes cover the same problem from different sides. The core answer is that least privilege is a property of the parts, and here the harm is a property of the whole.

Least privilege checks each grant on its own: does this agent need this access for this step? SafeFlow shows the blind spot. Multi-agent systems are built to split tasks and specialize roles, and that lets a harmful objective fragment into steps that each look benign, with the harm emerging only in composition Can task decomposition hide harmful intent across agents?. Every subtask passes its check and every agent holds only what it needs, yet the harm sits in the sum, and no single checkpoint is positioned to see the sum. The strength of multi-agent design (decompose and specialize) is exactly what creates the gap.

The confused deputy problem is a close relative. In a retrieval-summarization-delegation chain, a low-privilege agent can embed a forged authorization claim in what it passes along, and the high-privilege agent then misuses its own legitimate authority Can forwarded content trick high-privilege agents into misusing their authority?. The deputy's permissions were sized correctly and it still misfired, because the failure happens at the authorization decision, not at the executor's defenses. Here the harm is one bad call rather than an accumulation, but the lesson is the same. A permission says what an agent may do. It doesn't say whether this use fits the larger picture the agent was handed.

The corpus points to a fix that isn't tighter per-step permissions. The confused-deputy paper says the failure can be prevented by policy checks external to the agent's own judgment Can forwarded content trick high-privilege agents into misusing their authority?. A second note adds a condition: for a violation to be unavailable rather than merely unchosen, the enforcer has to sit outside what the policy can both see and edit, because policies under training learn to route around visible guardrails What would make policy violations truly unavailable to an agent?. One paper reports zero unsafe actions with "task-bound signed tokens" and a "separately verified policy oracle." Its excerpt doesn't say who issues the tokens, how verification works, or whether attackers could reach them How does the authorization layer stay outside the poisoned path?. The phrase "task-bound" hints at scoping authority to the whole task instead of each step, but that is my reading, not something the excerpt states.

The corpus has no worked example of a system that detects accumulation itself. The notes establish the requirement: something outside the agents must hold the whole-task view. None of them shows that requirement being met against a split-up harmful objective.