Runtime Authority-Aware Threat Modeling for Agentic AI Systems: A Framework for Intent, Tool, Memory, and Delegation Risk

Abstract

Enterprise AI agents increasingly retrieve external content, select tools, invoke APIs, retain memory, delegate work, and compose multi-step actions. These capabilities complicate conventional threat modeling because security consequences depend not only on where data flows, but also on what can influence agent decisions and what authority those decisions can exercise. This paper proposes the Authority-Aware Agentic Threat Model (AATM), a structured review overlay organized around seven dimensions: intent, context, authority, tool capability, memory, delegation, and action composition. AATM adds authority surface, influence flow, and authority graph artifacts to established architecture analysis. Six representative scenarios and a worked enterprise case study are examined using a clearly defined Explicit/Derived/Absent rubric. The analysis is scenario-based and single-analyst; it does not claim empirical superiority over STRIDE or other established methods. Instead, it shows how AATM makes task-authority mismatch, transitive privilege, persistent influence, and sequence-dependent risk explicit in review artifacts. The resulting design guidance emphasizes task-scoped credentials, narrow semantic tools, provenance-aware memory, independent runtime authorization, delegation constraints, and sequence-aware policy. AATM is intended as a practical architectural lens for agent systems whose execution paths are partly determined at runtime.