Delegation with different interests
A principal-agent problem exists when a principal delegates work to an agent, but the agent has different goals or incentives and knows more about its action or effort than the principal. In security, the agent can be an employee, administrator, vendor, cloud provider, software supplier, managed service, broker, or automated agent.
Hidden action and hidden information
The principal may not know whether a vendor patches promptly, an administrator follows review, a service isolates tenants, or a contractor protects credentials. The agent may select effort, risk, subcontractors, evidence, or incident disclosure while the principal bears much of the loss.
Map delegated objective, authority, resources, information advantage, allowed discretion, observable output, evidence, compensation, liability, exit, and emergency action.
Bound and observe delegation
Give the agent the minimum resource, action, context, and time needed. Make high-impact changes attributable and independently reviewable. Require useful evidence, not self-attestation alone. Separate approval, execution, and audit where consequence supports it. Align service levels and incentives with security outcomes that the agent can control.
Keep an exit and recovery path. A principal that cannot replace or revoke an agent has weak control even with detailed policy.
Failure and residual risk
More monitoring can create surveillance, cost, and gaming. Output metrics can reward visible but low-value work. Contracts cannot prevent all hidden action. The principal can lack expertise to judge evidence. A tightly constrained agent can be unable to handle exceptions and can create availability failure.
The principal can also set conflicting goals, insufficient budget, or impossible deadlines. Not every failure is agent misconduct.
Pomerium boundary
Pomerium can express route-level authority for employees, contractors, services, and agents and can record covered decisions. The resource owner must still define the delegated action, application permission, evidence, review, revocation, and consequence. A valid login does not show that the actor served the principal's objective.
Evaluation checklist
- What objective, authority, resource, time, and discretion did the principal delegate?
- Which action, effort, dependency, or security quality can the agent hide?
- Does evidence come from an independent observation or only from the agent's report?
- Can the principal narrow, suspend, replace, or recover from the agent without losing the resource?
- Do incentives reward the actual security outcome or a proxy that can be gamed?
