AIVSS02 - Agent Access Control Violation
Agent operates beyond its intended authorization boundary (permission escalation, role forgery, confused-deputy patterns).
Intent & Description
'
🎯 Intent
Prevent agents from escalating privileges or operating beyond their intended authorization boundaries.
📋 Context
Agents may be granted credentials or assume identities to perform tasks. Without proper controls, they can escalate privileges, forge roles, or act as confused deputies, exceeding their authorized scope. This is ranked as the #2 highest-severity risk.
💡 Solution
Apply least privilege principle. Use short-lived, scoped tokens. Implement identity verification at each action. Monitor for privilege escalation attempts. Use role-based access controls. Audit all identity assumptions. Implement strict permission boundaries.'
Real-world Use Case
Source
📌 TL;DR
Apply least privilege to agents. Use scoped tokens, verify identity per action, detect privilege escalation attempts.
Advantages
- Prevents privilege escalation
- Limits blast radius of compromise
- Enables access auditing
- Supports zero-trust principles
Disadvantages
- Token management adds complexity
- Least privilege requires careful scoping
- May break legitimate workflows