Kishore Pulagam

In 1988, Norm Hardy described a program that was tricked into misusing its own authority. It had legitimate permission to write a file, a user handed it the wrong target, and the system had no way to tell whose intent it was serving. He called it the confused deputy. For decades, it was a well-understood problem with well-understood answers. AI agents bring it back. An agent acts on a user’s behalf with delegated authority. It calls tools, reads documents, browses content, and decides what to do next based on what it reads. Our authorization models were built for a world where software followed fixed logic and permissions were granted once. Agents don’t work that way. Every action is a fresh decision, and the input driving that decision can come from anyone. When untrusted content can steer a program that holds real authority, the agent becomes the deputy, and the attacker no longer needs credentials. They just need to be read. In this talk, I’ll start with the classic problem and show how it reappears in agent systems, using public exploits that have already hit widely used agent tooling. From there, I’ll frame the hour around three questions that every system built on agents has to answer. The first question is who is authorized, for this action, right now. Authority can’t be a one-time grant. Rather, it has to be decided at the point of action, based on the user, the agent, the tool, and the data involved. In regulated environments this gets harder, because the policies an agent must respect often come from different regimes that conflict with each other. I’ll share how my published research approaches detecting those conflicts before they turn into inconsistent enforcement. The second question is what the agent is reading, and whether it should trust it. Retrieval and context are part of the security boundary, not just a quality concern. They decide what the agent can see and what it can be manipulated by, across text and images alike. I’ll draw on my retrieval research to show why shared knowledge layers need to be designed with that boundary in mind. The third question is how we contain the damage when something goes wrong. I’ll walk through the design patterns that hold up today for limiting what an agent can reach, what it can act on, and how far any single mistake can travel. This session is meant for students and early-career engineers, and it doesn’t assume a background in security or AI infrastructure. At the end of the day, the goal is a clear mental model: how authority flows through an agent system, where it breaks, and what it takes to build agents we can actually trust with real access. I’ll close with the open research problems I think are worth working on next.

Biography:

Kishore is a Senior Member of Technical Staff at PayPal in Austin, Texas, where he spent more than thirteen years architecting enterprise platforms that operate at global scale. His work spans distributed systems, AI inference and retrieval, and agentic systems. Much of it is about how organizations put AI to work on sensitive data safely, with governance, privacy, and regulatory controls built into the platform itself rather than added on top. Kishore's independent research focuses on information retrieval, knowledge representation for regulatory compliance, and governed agentic workflows. He published peer-reviewed work in IEEE Access, and he serves as a peer reviewer for IEEE. He speak on AI platforms and agent security, most recently at PLATFORMday Austin. Kishore holds an MSc in Computer Networks from Middlesex University London, and he is completing an Executive MBA at Northwestern University’s Kellogg School of Management.

Email:

Sai Gavaskar Sakalam

Email: