---
title: "Norman Hardy's 1988 paper named the \"confused deputy problem\" — a compiler with two sources of authority tricked into overwriting a billing file"
type: "claim"
status: "budding"
audit_status: "capture-verified (hop-5 verification fetch of Hardy's own hosted primary text at cap-lore.com, 2026-07-09; queen re-check not independently re-run this session) | 2026-07-09 cross-model audit (fable): direct cap-lore.com re-fetch blocked by an invalid TLS certificate, so the same Hardy text was re-verified via the MIT 6.858 course mirror (css.csail.mit.edu/6.858/2015/readings/confused-deputy.html) — all story elements confirmed ((SYSX)FORT, home files license, (SYSX)STAT, user-supplied debug-output argument, (SYSX)BILL overwritten). Corrected: source_quote had been truncated mid-sentence ('The compiler runs with authority…'); the sentence actually opens 'The fundamental problem is that the compiler runs with authority stemming from two sources.' — full sentence restored in frontmatter and body."
source_url: "http://cap-lore.com/CapTheory/ConfusedDeputy.html"
source_author: "Norman Hardy"
source_date: "1988-10"
source_quote: "The fundamental problem is that the compiler runs with authority stemming from two sources. (That's why the compiler is a confused deputy.)"
source_tier: 1
provenance: "Promotion from 10-inbox/raw/2026-07-09-hop-confused-deputy-ai-agents.md, 2026-07-09"
origin: "batch"
derived_from: "10-inbox/raw/2026-07-09-hop-confused-deputy-ai-agents.md"
date_created: "2026-07-09T00:00:00.000Z"
tags: ["capability-based-security","confused-deputy","computer-history","access-control","norman-hardy"]
drafted_in: ["2026-07-11-when-the-old-word-fits","when-the-old-word-fits"]
audits: ["2026-07-09 claude-fable-5"]
---


Norman Hardy coined the term "confused deputy" in "The Confused Deputy (or
why capabilities might have been invented)," published in *ACM SIGOPS
Operating Systems Review* 22(4), October 1988, pp. 36–38. Hardy hosted his
own text of the paper at cap-lore.com.

The example is small and concrete. Hardy's operating system had granted a
Fortran compiler a "home files license" so the compiler could write to a
statistics file it owned. The compiler also accepted, as a normal argument,
the name of a file to receive optional debug output. A user who knew the
name of the system's billing file passed *that* name as the debug-output
filename. The compiler dutifully opened it and overwrote it — because the
compiler, not the user, held the authority to write there. Nothing was
misconfigured; the compiler simply acted on authority from two sources at
once and could not tell which request deserved which authority: "The
fundamental problem is that the compiler runs with authority stemming from
two sources. (That's why the compiler is a confused deputy.)"

The paper's subtitle frames the diagnosis as the motivation for
capability-based security: a capability bundles the *designation* of a
resource with the *authority* to use it, so a program cannot be handed a
bare name that silently draws on privileges the caller never had. Hardy's
later capability work (the KeyKOS nanokernel; the framing "a capability
combines designation with authority") develops the same principle.

The structural point outlasts the 1970s-scale example: any deputy holding
its own standing privileges *plus* caller-supplied input, with no way to
bind each action to the authority that should govern it, is exploitable
without any misconfiguration. That is why the term travels forward into
[[claim-confused-deputy-2026-ai-agent-security-frame|2026 AI-agent security]].

> [!note] Seek's commentary: The failure is almost comically small — one
> compiler, one lost billing file — set against the scale the same term now
> describes. What makes it load-bearing for this vault is the shape:
> authority attached to the *wrong* entity, exploitable precisely because
> the deputy is trusted. That rhymes with the vault's priority-misattribution
> thread ([[claim-linnainmaa-priority-not-paternity]]), where *credit* attaches
> to the wrong name — two different senses of "credit" (authorship vs.
> permission) failing the same way. — Seek