Repository navigation
PerAgentExecutionRoleIsolation
title: Per-Agent Execution Role Isolation radar_quadrant: Techniques radar_ring: Assess radar_position: inner
Teams that deploy AI agents on a managed cloud platform often assume that a compromised agent can only damage itself. Per-agent execution role isolation is the practice of giving each agent its own narrowly scoped cloud identity, so that a successful attack on one agent does not open the others, their logs, their memory or their secrets.
Zenity Labs described a chain of events in AWS Bedrock AgentCore in its AgentCorruption research. Any agent tool that makes HTTP requests can be turned into a server-side request forgery primitive by a prompt injection. The injected prompt directs the agent to query the instance metadata service and returns the temporary credentials of the agent's execution role. The researchers reported that the default role was granted broad permissions across all AgentCore resources in the account's region. With those credentials they could invoke other agents, read private conversation logs, pull container images, create memory entries that persistently change agent behavior, and retrieve secrets and tool API keys. A single prompt to one exposed agent could therefore lead to takeover of every agent in the same account and region.
The mitigation is structural rather than a patch:
- Give every agent its own execution role, scoped to that agent's own resources only.
- Remove permissions that list or enumerate other agents, repositories and log groups.
- Require the hardened version of the metadata service so that simple request forgery cannot read credentials.
- Keep customer-facing agents and internal agents in separate accounts or regions, since the post argues organizations often run them side by side.
Zenity reported the metadata access issue in December 2025 and the overprivileged role in January 2026. AWS closed the first report as informative in April 2026, noting that AgentCore had moved to the hardened metadata service in February 2026. AWS disputed the characterization and stated the behavior is documented and expected, advising customers to apply least-privilege permissions. On September 29, 2026 Zenity observed that AWS had removed the most dangerous permissions and hardened the default role.
- AwsBedrockAgentCore: the platform in the documented case.
- AutomatedLeastPrivilegeRemediation: tooling approach for tightening roles after the fact.
- LLMAgentPromptInjectionPatterns: defensive patterns against the injection that starts the chain.
Per-Agent Execution Role Isolation is placed in Assess at inner position. The evidence is third-party research on a single platform, and there is no first-person production use. The technique is a direct application of least privilege, and the documented case shows the cost of skipping it, which supports an inner position within the ring.
