01 / Attack path
How the boundary is crossed
A parent grant is revoked in region A while a child in region B uses a previously cached ALLOW to restart a server.
- 01Lower-trust input
- 02Attempted instruction
- 03Protected action
- 04Enforced decision
02 / Containment
Where bounded authority limits the effect
Define a revocation consistency requirement, invalidate caches, recheck high-impact actions at the executor and fail closed when freshness cannot be proven.
Architecture review / negative test
Make the boundary testable.
The race window spans revocation issuance, propagation, cache invalidation and the executor’s final check. Record each timestamp rather than claiming instantaneous effect. High-impact operations may need a stronger consistency guarantee than low-risk reads, especially across regions or disconnected edge runtimes.
03 / Failure and evidence
The attacker’s opportunity and the defender’s record
Operators assume revocation is immediate while asynchronous propagation leaves an execution window.
Measure notification and enforcement timestamps and record any action attempted in that interval.
04 / Canonical scope
Why this reference stands alone
Revoking child agents covers graph invalidation; this threat analysis owns timing and distributed-system failure.
Technical deep dive
Measure the interval between withdrawal and last enforceable check.
Revocation has at least four times: operator withdrawal, distribution, cache invalidation and the executor’s next evaluation. Treating them as one timestamp hides the race. A cross-region or disconnected runtime may retain a locally valid credential after the originating grant ends. High-consequence operations should document a maximum propagation window and the failure mode when freshness cannot be established. Do not claim instantaneous revocation without measured evidence.
t0 Parent grant revoked in region A t1 Revocation event emitted t2 Region B cache invalidated t3 Child requests server.restart t4 Executor checks ancestor state → DENY Risk window: t0 through final fresh check
Run the negative test
Warm an ALLOW cache in region B, revoke the parent in region A, then attempt a restart before and after the declared propagation bound. Repeat under a network partition. Record any escaped effect and the alarm path; a stale credential must not silently extend high-impact authority.
Continue to Fail-closed behavior for the adjacent boundary.
Primary references