CapChain: A Capability-Token Access Control Architecture with Verifiable Provenance for Multi-Agent LLM Systems

Abstract

Multi-agent large language model (LLM) systems built on LangGraph-style frameworks share an unencrypted state store with no field-level read access control, so one agent can read another’s private fields. The 2026 OWASP Agentic Top 10 and CVE-2025-67644 show that this layer is already being exploited. We propose CapChain, a replacement for the step that merges each agent’s output into shared state, with three primitives: capability tokens that cryptographically bind which agent may read which field, a tamper-evident provenance log with logarithmic-cost audit, and a capability-aware reducer that decides whether each field may be forwarded, redacting and logging unauthorized merges. We evaluate the reducer’s attribute–purpose gate on the MAGPIE contextual-privacy benchmark, with scoring based on two deterministic tiers: verbatim matching and keyword-and-entity salience. Across 150 conditions (25 scenarios × 3 open-source models × 2 instruction modes), the Salient tier triggers the redactor for 4.67% of inter-agent messages. This rate counts the reducer’s gate activations (redaction decisions), not leakage prevented. By relocating enforcement from the language model to the state-transition layer that graph-structured orchestrators expose, CapChain brings cryptographic, capability-based access control and audit-by-construction provenance to a structural locus that prompt-level defenses cannot reach.