01 / Attack path
How the boundary is crossed
An agent authorized to refund order A starts a second ticket and attaches the old approval to order B.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Bind grants and approvals to stable workflow and target IDs, clear task context on handoff, and reject any mismatched executor request.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
A session-level role is mistaken for permission across every workflow in that session.
Record both workflow IDs, grant binding, attempted target and denial.
04 / Canonical scope
Why this reference stands alone
Approval replay addresses repeated consent; this page owns context crossover between work items.
Protocol or attack trace
Task-context swap
Approval for refund order A remains in agent session when it processes unrelated order B.
Executor compares approval task and immutable order with current request and denies B.
Primary references