01 / Attack path
How the boundary is crossed
A finance agent reads a ledger for reconciliation, then sends it to an external mailbox supplied by a document comment.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Authorize export separately from read, constrain recipient and data classification, and block the send at the mail or network executor.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
The read credential and send credential together create an unreviewed data-transfer capability.
Correlate source record, destination, content digest, decision and outbound delivery result without logging the ledger.
04 / Canonical scope
Why this reference stands alone
Prompt injection can induce the attempt; this page owns the protected-data egress effect.
Protocol or attack trace
Read-to-send escalation
Agent reads ledger under reconciliation task; document comment supplies external mailbox as export recipient.
Mail executor requires distinct export grant for ledger class and exact recipient; deny mere read authority.
Primary references