Agentic AI systems are increasingly ca-pable of executing multi-step plans, in-voking external tools, browsing the web, and modifying persistent state with lim-ited human supervision. This capability expansion introduces a critical yet un-deraddressed security challenge: by what authority does an agent act, and how can that authority be enforced efficiently at runtime? Current approaches to delega-tion safety are either static and brittle (allowlist-based access control), computa-tionally prohibitive (always-on large lan-guage model monitoring), or retrospec-tive and non-preventive (logging-only au-diting). None is suitable for the resource-constrained environments—edge devices, on-device copilots, bandwidth-limited en-terprise endpoints—where agentic sys-tems are rapidly being deployed.

This paper proposes CapFence, a lightweight runtime delegation layer that addresses this gap through four tightly integrated components: (i) a capabil-ity compiler that translates natural-language intent into structured, least-privilege capability tokens; (ii) a com-pact risk gate that scores each pro-posed action using a low-cost calibrated model; (iii) a selective escalation mecha-nism that reserves expensive verification for genuinely ambiguous actions; and

(iv) a compressed audit chain that sup-ports retrospective accountability with-out verbose trace retention. Motivated by the authenticated-delegation prob-lem articulated by South et al. [1] and the deployment-visibility tradeoffs doc-umented by Chan et al. [2], CapFence targets simultaneous reductions in de-cision latency (≈75%), token cost over-head (≈77%), false-positive rate (≈46%), and peak memory footprint relative to an always-on LLM monitor, while re-taining task success on the GAIA, We-bArena, Mind2Web, VisualWebArena, and AgentBench benchmark suites. The primary contribution is a governance primitive that makes least-privilege del-egation both principled and practically deployable.

Keywords: Agentic AI, authenticated delegation, runtime gating, capability to-kens, selective escalation, auditability, edge deployment.