01 / Attack path
How the boundary is crossed
A support agent’s service token can delete every tenant although its task is read-only.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Use least-capable downstream identity, narrow resource audience and require a per-action interlock for destructive tools.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
Exploit condition
An injection or wrapper bypass reaches broad service privileges.
Evidence to retain
Credential scope, tool request, policy result, direct-call detection and tenant effect.
04 / Canonical scope
Why this reference stands alone
Agent credential lifecycle covers handling; this threat owns privilege excess and blast radius.
Technical artifact
Compare task scope with backing credential
task grant: ticket.read(customer-42) backing service token: customer.* across all tenants agent attempts customer.delete(customer-99) policy PEP: DENY; direct API credential path: dangerous remediation: narrow backing credential and gate API
Run the denial test
Bypass the agent tool wrapper and invoke delete through the same service token. If the API accepts it, the architecture has a material enforcement gap.
Primary references