The credential is valid. The act is unauthorized.
Each demo runs the same task twice. Once under a wide grant, where the action is allowed to complete. Once under least privilege, where it is refused at the act — before it commits. Same agent, same request, same injection — one on an ARM edge node, one on an x86 server.
Nothing here turns on a clever exploit. The agent is doing its job with authority somebody legitimately gave it, and a single action reaches past what the task intended — a redirect to an address nobody asked for, a hidden hook writing into another repository. Under a wide grant, that action runs. Under least privilege, the same run proceeds normally until the one offending act, which is refused before it takes effect. The grant is a signed, per-action authority, not a standing session.
A redirect the grant never named
The decision is on the connection itself, not the address the agent asked for. An allowed request can still end somewhere the grant does not reach.
- The setupAn agent on an ARM edge board, with a
fetchtool, is asked to retrieve package metadata from a registry. - The redirectThe registry responds with a redirect that points the request at a different address — one the task never named.
- Wide grantThe redirect is permitted. Data comes back from a source the agent never requested, and nothing marks the difference.
- Least privilegeThe connection to the registry is allowed; the redirect to the unnamed address is refused at the act. Zero bytes reach it, and the call fails closed rather than returning a partial response.
A git hook reaching into another repository
A checkout is hundreds of file actions. The safe ones run; only the one that leaves the granted directory is refused.
- The setupAn agent on an x86 server, with a
gittool, is asked to check out the default branch of a demo-app repository. - The hookThe repository carries a hidden post-checkout hook that writes into a separate, sensitive repository,
shared-infra. - Wide grantThe checkout runs, and the background hook writes into
shared-infrauninhibited — buried in the hundreds of ordinary file actions a checkout performs. - Least privilegeScoped to
demo-app, the checkout's safe actions complete; the one act reachingshared-infrais denied before it commits. The external repository is untouched.