Revocation race conditions for agents

A revocation race exists between the decision to withdraw authority and every enforcement point learning and applying it.

01 / Attack path

How the boundary is crossed

A parent grant is revoked in region A while a child in region B uses a previously cached ALLOW to restart a server.

Attack path and interception point
  1. 01Lower-trust input
  2. 02Attempted instruction
  3. 03Protected action
  4. 04Enforced decision

02 / Containment

Where bounded authority limits the effect

Define a revocation consistency requirement, invalidate caches, recheck high-impact actions at the executor and fail closed when freshness cannot be proven.

Architecture review / negative test

Make the boundary testable.

The race window spans revocation issuance, propagation, cache invalidation and the executor’s final check. Record each timestamp rather than claiming instantaneous effect. High-impact operations may need a stronger consistency guarantee than low-risk reads, especially across regions or disconnected edge runtimes.

03 / Failure and evidence

The attacker’s opportunity and the defender’s record

Exploit condition

Operators assume revocation is immediate while asynchronous propagation leaves an execution window.

Evidence to retain

Measure notification and enforcement timestamps and record any action attempted in that interval.

04 / Canonical scope

Why this reference stands alone

Revoking child agents covers graph invalidation; this threat analysis owns timing and distributed-system failure.

Technical deep dive

Measure the interval between withdrawal and last enforceable check.

Revocation has at least four times: operator withdrawal, distribution, cache invalidation and the executor’s next evaluation. Treating them as one timestamp hides the race. A cross-region or disconnected runtime may retain a locally valid credential after the originating grant ends. High-consequence operations should document a maximum propagation window and the failure mode when freshness cannot be established. Do not claim instantaneous revocation without measured evidence.

Race timeline
t0  Parent grant revoked in region A
t1  Revocation event emitted
t2  Region B cache invalidated
t3  Child requests server.restart
t4  Executor checks ancestor state → DENY
Risk window: t0 through final fresh check

Run the negative test

Warm an ALLOW cache in region B, revoke the parent in region A, then attempt a restart before and after the declared propagation bound. Repeat under a network partition. Record any escaped effect and the alarm path; a stale credential must not silently extend high-impact authority.

Continue to Fail-closed behavior for the adjacent boundary.

Primary references

Read the underlying material

Architecture discussion

Choose one consequential action and make its boundary explicit.

Request a Conversation