County IT maps inter-agent message schemas to stop agents from invoking payroll APIs on another service’s behalf. What failure is being prevented?
Select an answer to reveal the explanation.
Short Explanation
A confused deputy is when Helper A uses Boss B’s badge to open Payroll without meaning to — or because someone tricked it. Schema and authority checks stop agents from spending privileges they should not wield. Map the messages so deputies stay unconfused.
Full Explanation
County IT mapping inter-agent message schemas to stop agents from invoking payroll APIs on another service’s behalf is preventing confused-deputy calls where an agent misuses another service’s privileges. A confused deputy occurs when a privileged helper is tricked into exercising its authority for a requester who should not get that outcome. In municipal microservice estates, clear schemas, audience restrictions, and token audience/binding reduce agents acting as deputies that call payroll with borrowed or ambient authority.
Benign load balancing across municipal microservices fails by concept: load balancing is traffic distribution, not privilege misuse across services. Normal OAuth consent for employee self-service portals describes an intended user-delegated access pattern, not an agent invoking payroll on another service’s behalf through confused authority. Routine DNS caching on the county intranet is name-resolution performance and unrelated to confused-deputy API abuse.
Exam caveat: schema mapping helps define intended call patterns; preventing confused deputy also requires per-audience tokens, explicit acting-for checks, and refusing to reuse one service’s credentials for another service’s payroll APIs. Operational check: attempt to coerce a non-payroll agent to call payroll using another service’s token or ambient credentials in a test environment and confirm rejection based on audience/schema policy; verify payroll tokens are not shareable across unrelated agent services.