01 / Attack path
How the boundary is crossed
A child with read access asks another agent to issue a new write grant for the same task.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Validate effective rights against the original accountable source and every applicable parent, regardless of reissue route.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
Two narrow grants are unioned into a broader right never approved by the originator.
Original scope, reissue request, intersection calculation, denial and downstream attempt.
04 / Canonical scope
Why this reference stands alone
Monotonic narrowing checks each edge; this threat page covers cross-path privilege amplification.
Technical artifact
Do not union permissions from unrelated branches
origin O permits read invoice I42 branch A permits prepare invoice I42 branch B permits release invoice I42 but lacks O ancestry combined request release(I42) → DENY no valid single origin chain grants release
Run the denial test
Give a child one read grant and one write grant from different origins. A union algorithm will create a permission neither origin approved; require an authorized intersection or explicit new grant.
Primary references