tools / agent audit / rules / can do more than a role it acts for · v0.1.0 · View source · Edit on GitHub
Agent audit rule · v0.1.0
Can do more than a role it acts for
The agent acts for this role, but it can take actions the role is not allowed to take, so a person in that role can ask the agent to do them (confused deputy). High for money, identity, health records and deletes; medium otherwise.
- high base severity
- 4 test fixtures
high exceeds-role
Flagged
// tools.json
1 [
2 {
3 > "name": "issue_refund",
4 "input_schema": {
5 "type": "object",Fix
Check the role server-side before each action, or narrow the action (lower cap, own-records only) so it fits the least-privileged role it serves. If the role should have it, add an allow entry such as `*refund*:<=50`.
Fine
// tools.json
[
{
"name": "issue_refund",
"input_schema": {
"type": "object",
"properties": {
"amount": {
"type": "number",
"maximum": 40
}
}
}
}
]
// agent.json
{
"agent": {
"name": "Refund bot",
"acts_for": [
"customer",
"support-agent"
]
},
"roles": {
"customer": {
"allow": [
"*refund*:<=50"
]
},
"support-agent": {
"allow": [
"*refund*:<=200"
]
}
}
}