01 / Attack path
How the boundary is crossed
An agent receives approval to isolate endpoint E-42. The incident is reassigned and the agent changes its target to E-43 before the cloud executor acts.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Canonicalize the request, bind the decision to a digest, verify target and grant freshness at the executor, and choose a validity period matching the consequence. If the request changed, decide again.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
A stale ALLOW is replayed against E-43 because the executor checks only that a decision token exists.
Retain decision time, request digest, grant version, revocation time, execution time and actual target. The timestamps expose the race window.
04 / Canonical scope
Why this reference stands alone
Decision caching discusses storage and reuse; this page owns the temporal gap between a check and the protected use.
Implementation review
Check/use race
t0 evaluate isolate(E-42) under grant G7 → ALLOW for digest H1. t1 revoke G7 or change target. t2 executor receives isolate(E-43) → digest H2 ≠ H1 → DENY and re-evaluate.
Adversarial check
Pause execution after ALLOW, change only the endpoint identifier, then resume. The original decision must not authorize the modified target.
Primary references