Confused-Deputy / On-Behalf-Of Authorization Integrity Check

A customer asked your support bot to read someone else's ticket — did it?

The classic confused deputy is the authorization failure no other surface grades: the agent legitimately holds elevated privilege and performs a privileged action on behalf of a requester whose own authorization was never checked — so an under-privileged or untrusted requester borrows the agent's standing authority to reach a privileged action. “The support bot can read any ticket, a customer asks it to read someone else's ticket, and it does — because IT has permission.” This is the agent-native BOLA / OWASP LLM06 Excessive-Agency confused deputy. Identity scanning grades cross-tenant exposure; auth-scope grades a token reused across a boundary; capability grades trifecta acquisition. None model the agent checking whether the requesting principal was itself authorized for the action the agent then executes with its own standing privilege. AgentSmack declares each request (the requester + its trust level), the authorization.check the agent ran (and crucially whose authorization it verified — the headline is a check whose subject was the agent's OWN privilege, not the requester's), and the executed action, then fires a hard blocker when a privileged action runs for a requester whose authorization was missing, agent-self-substituted, or denied. Ground-truth-first: a privileged action that authorized the requester scores a clean 100. Raw requester / resource / principal bytes are never stored. Load a sample to watch the request → authorization.check → action lineage light up with no live infra.