tools / agent audit / rules / reads or writes any person's record by id · v0.1.0 · View source · Edit on GitHub
Agent audit rule · v0.1.0
Reads or writes any person's record by id
The action takes a record id (patient, customer, account, user) for sensitive data and nothing ties it to the person the agent acts for, so a prompt can make it fetch someone else's record (broken object-level authorisation). Critical for health records. Without a manifest it is reported one level lower. When a manifest role declares the action own-only (`read:own`) it is reported low: the declaration cannot be checked from the spec, which still accepts any id.
- high base severity
- 4 test fixtures
high unscoped-record-access
Flagged
// tools.json
5 "type": "object",
6 "properties": {
7 > "patient_id": {
8 "type": "string"
9 }Fix
Derive the record id from the authenticated requester server-side instead of taking it as a parameter, and declare the restriction in the manifest role (`allow: ["read:own"]`).
Fine
// tools.json
[
{
"name": "get_customer",
"input_schema": {
"type": "object",
"properties": {}
}
}
]
// agent.json
{
"agent": {
"name": "Support bot",
"acts_for": [
"customer"
]
},
"roles": {
"customer": {
"allow": [
"read:own"
]
}
}
}