Formal Scope Intersection for Preventing Excessive Agency and Confused Deputy Escalation
An automated assistant holds broad administrative database credentials to answer questions across departments, and a regular user tricks it into running an administrative update. The verifier tests permission inheritance across role boundaries and compiles a strict scope-intersection contract.
Excessive agency arises when an assistant is granted shared service-account credentials or write-capable tools that exceed the permissions of the human caller. In this confused deputy arrangement, the downstream service trusts the assistant's static bearer token. It executes the command without verifying whether the originating user possesses authority for the requested action.
Security Officer (Plain Meaning): Halts "Execute privileged payroll table UPDATE under service account credentials on behalf of a read-only caller" before socket (0 live DB damage, signed GOST receipt)
IT Auditor & SecOps (Evidence): Scope OWASP LLM06:2025 / ASI03 | Wire Rule SEC-ZD-AI-03 | Formal Witness 7c31e5028a941d63
Technocrat, CTO & VC (Moat): Z3 Invariant (assert (subset (tool_required_scopes call) (intersect (ca... | FP = 0.0% | Contract IMMUNE-AI-7C31E502 (mcp-sentinel 1.1.2)1. Thought-to-Action Interception and Contract Schematic for AI-AGN-03
Deterministic verification flow for AI-AGN-03 (OWASP LLM06:2025 / ASI03, MITRE ATLAS AML.T0054): candidate probe interception by wire filter SEC-ZD-AI-03, differential proof via witness 7c31e5028a941d63, and synthesis of gateway contract IMMUNE-AI-7C31E502 for mcp-sentinel.
2. In-Path Mutation Blocking and Formal Solver Invariant for AI-AGN-03
Under rule SEC-ZD-AI-03, the in-path software filter intercepts every state-changing tool invocation before transmission. It evaluates the intersection between the caller's authenticated role claims and the minimum scope required by the target tool. Administrative mutations, schema updates, and permission grants initiated from a read-only user context are halted immediately.
On the benchmark stand, the verifier executes cross-role delegation probes using a synthetic read-only analyst token attempting to invoke an administrative mutation tool. Comparing the result against a decoy route enforcing caller binding confirms the flaw via witness 7c31e5028a941d63 with zero false alarms.
Class Identifier: AI-AGN-03 (excessive_agency_confused_deputy)
Taxonomy Concordance: OWASP LLM06:2025 / ASI03 | MITRE ATLAS AML.T0054
Execution Mode: Active Safe Probing (AUTO_SCAN)
Candidate Probe: POST /mcp/v1/tools/call {"name":"db_admin_execute","arguments":{"sql":"UPDATE payroll SET salary=250000 WHERE emp_id=402"},"context":{"caller_role":"read_only_analyst"}}
Blocked Mutation: Execute privileged payroll table UPDATE under service account credentials on behalf of a read-only caller
Z3 Solver Invariant: (assert (subset (tool_required_scopes call) (intersect (caller_scopes user) (session_task_scopes task))))
Wire Sandbox Rule: SEC-ZD-AI-03
Formal Witness Hash: 7c31e5028a941d63
Compiled Sentinel Rule: IMMUNE-AI-7C31E502 (mcp-sentinel 1.1.2)3. Autonomous Synthesis of Gateway Contract IMMUNE-AI-7C31E502 and Streebog-256 Receipt
Witness 7c31e5028a941d63 compiles into gateway rule IMMUNE-AI-7C31E502 for border enforcement. The rule enforces the mathematical invariant that the permitted action set of any tool call stays within the intersection of caller permissions and task scope.
4. Engineering Reference Notes for AI-AGN-03
Elimination of shared superuser tokens in autonomous tool execution
The gateway binds every outbound tool request to a scoped, session-attenuated token derived from the human initiator's session claims rather than forwarding a static service credential.
Handling multi-step workflows that require read access to reference tables
The solver evaluates read and write scopes separately, permitting approved lookup queries on reference tables while strictly blocking any write, delete, or export operation outside the caller's role.