01 / Attack path
How the boundary is crossed
A support agent with a customer-admin token uses a simple address-change task to delete a customer record.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Reduce downstream credential scope where possible and interlock each operation and target against the originating ticket.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
The API accepts the token’s administrative role as sufficient authority for all agent-generated calls.
Record credential scope, task grant, delete request, denial and downstream state.
04 / Canonical scope
Why this reference stands alone
Long-lived credentials addresses duration; this threat addresses excessive breadth at action time.
Protocol or attack trace
Broad-token abuse test
Address-change task carries customer-admin token; agent invokes delete_customer.
Downstream executor denies delete without a task-specific operation grant even though token has admin role.
Primary references