01 / Attack path
How the boundary is crossed
A parent agent with invoice-read authority spawns children and orders them to release payments.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Verify every child grant is a strict subset of the parent, constrain delegation depth and shared budget, and check the final payment action independently.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
Child processes inherit a broad parent token and turn one compromised coordinator into many payment actors.
Keep parent and child grants, subset checks, fan-out count, payment denials and origin of instructions.
04 / Canonical scope
Why this reference stands alone
Delegation amplification owns aggregate fan-out; this page owns compromise of the parent principal.
Protocol or attack trace
Malicious child grant
Compromised read-only coordinator spawns children and issues payment instructions.
Reject child grant wider than parent and reject final payment independently of child identity.
Primary references