Confused Deputy
A privileged component tricked into performing an action on behalf of a caller who lacks the authority to perform it directly.
The vulnerability class that most often survives a security review, because every individual component is behaving correctly. The deputy has legitimate elevated privileges; the caller is legitimately authenticated; the flaw is that the deputy uses its own authority to perform an action it was asked to perform, without checking whether the requester was entitled to it.
The everyday form in service architectures: an internal API accepts a customer identifier and returns that customer's data, authenticating the calling service rather than the end user. Any service — or anyone who can reach the internal network — can request any customer. The batch job, the admin tool and the reporting service are all deputies of this kind.
The variant that has become urgent is the AI agent with tools. A model instructed by untrusted content to call a tool is precisely a confused deputy, and if the tool executes with the application's credentials rather than the requesting user's, the model has become a universal privilege escalation path.
The defence is consistent across all of them: carry the end user's authority through the call chain and evaluate authorisation against it at the resource, not at the entry point. Where the deputy must act on its own behalf, its privileges should be scoped to exactly what its own function requires — and never to a superset that spans every user.