critical
risk 64/100
Segregation of duties
Deterministic check
support_bot ↗
Critical data-exfiltration path
SupportBot can read customer PII and directly send external email, creating a direct path for confidential customer data to be exfiltrated outside the organization, exposing the firm to regulatory violations, financial penalties, and reputational harm.
Recommended actionRevoke the direct read_customer_pii and send_external_email grants from SupportBot; implement least‑privilege controls, require mediated approval for external egress, and add monitoring/auditing of any PII access and outbound email activity.
Evidence
agentsupport_bot
toolread_customer_pii
toolsend_external_email
Control frameworks context, not certification
NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties
SOC 2 Trust Services Criteria (2017) · CC6.3 Access modification and segregation of duties
ISO/IEC 27001:2022 · A.5.15 Access control
ISO/IEC 27001:2022 · A.5.18 Access rights
SOX ITGC · SoD Segregation of duties over financial processes
EU AI Act (Regulation (EU) 2024/1689) · Art. 14 Human oversight
Data protection — least privilege and controlled external egress
high
risk 58/100
Over-privilege
Deterministic check
report_bot ↗
Unused standing access: 2 direct grants
ReportBot holds standing privileges to delete records and export data that are never exercised. If the agent were compromised or misused, an attacker could invoke these unused grants to irreversibly remove critical data or exfiltrate sensitive information, exposing the organization to data loss, regulatory non‑compliance, and reputational damage.
Recommended actionRevoke the unnecessary delete_records and export_data grants from ReportBot and re‑certify its access against the principle of least privilege. Implement periodic review of granted versus used permissions for all agents.
Evidence
agentreport_bot
tooldelete_records
toolexport_data
Control frameworks context, not certification
NIST SP 800-53 Rev. 5 · AC-6 / AC-6(1) Least Privilege / Authorize Access to Security Functions
SOC 2 Trust Services Criteria (2017) · CC6.1 Logical access security
SOC 2 Trust Services Criteria (2017) · CC6.3 Access modification and segregation of duties
ISO/IEC 27001:2022 · A.8.2 Privileged access rights
ISO/IEC 27001:2022 · A.5.18 Access rights
SOX ITGC · Least privilege Least-privilege provisioning
Least privilege — access certification using granted versus used access
critical
risk 54/100
Segregation of duties
Deterministic check
invoice_bot ↗
Critical fraud path: create vendor and approve payment
InvoiceBot possesses both the create_vendor and approve_payment tool grants, giving a single automated agent the ability to add new vendors and subsequently authorize payments to those vendors. This concentration of authority creates a direct fraud pathway that could be exploited to generate fictitious vendors and approve unauthorized disbursements, potentially resulting in material financial loss and SOX compliance violations across the entire accounts‑payable function.
Recommended actionImplement segregation of duties by revoking either the create_vendor or approve_payment grant from InvoiceBot, enforce dual‑approval controls for vendor creation and payment authorization, and add continuous monitoring to detect any instance where a single entity performs both actions.
Evidence
agentinvoice_bot
toolapprove_payment
toolcreate_vendor
Control frameworks context, not certification
NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties
SOC 2 Trust Services Criteria (2017) · CC6.3 Access modification and segregation of duties
ISO/IEC 27001:2022 · A.5.15 Access control
ISO/IEC 27001:2022 · A.5.18 Access rights
SOX ITGC · SoD Segregation of duties over financial processes
EU AI Act (Regulation (EU) 2024/1689) · Art. 14 Human oversight
SOX ITGC — segregation of duties (vendor creation versus payment approval)
critical
risk 54/100
Segregation of duties
Deterministic check
payroll_bot ↗
Critical ghost-employee fraud path
PayrollBot holds direct authority to both add_employee (employee creation) and run_payroll (payroll execution). This conflation of employee setup and payroll processing creates a critical segregation‑of‑duties violation, enabling a malicious or compromised bot to create ghost employees and issue unauthorized payroll payments, potentially resulting in financial loss, regulatory non‑compliance, and reputational harm across the entire payroll function.
Recommended actionRe‑engineer the permission model to enforce segregation of duties: remove the direct add_employee grant from PayrollBot, require an independent approval workflow for employee creation, and limit payroll execution to a separate, controlled role. Implement least‑privilege access, periodic access reviews, and monitoring of employee‑creation and payroll‑run activities.
Evidence
agentpayroll_bot
tooladd_employee
toolrun_payroll
Control frameworks context, not certification
NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties
SOC 2 Trust Services Criteria (2017) · CC6.3 Access modification and segregation of duties
ISO/IEC 27001:2022 · A.5.15 Access control
ISO/IEC 27001:2022 · A.5.18 Access rights
SOX ITGC · SoD Segregation of duties over financial processes
EU AI Act (Regulation (EU) 2024/1689) · Art. 14 Human oversight
SOX ITGC — segregation of duties (employee setup versus payroll execution)
high
risk 54/100
Segregation of duties
LLM-generalized
sales_bot ↗
AI-generalized toxic capability combination: Read CRM account context + Send email outside the company
The SalesBot agent can both read CRM account context and send email outside the company, creating a direct path to expose customer information to external recipients. This combination can lead to unauthorized data disclosure, regulatory non‑compliance, reputational damage, and potential financial loss.
Recommended actionSeparate the read_crm and send_external_email permissions, enforce a dual‑approval workflow for any external email that includes CRM data, and implement continuous monitoring and audit of combined usage.
Evidence
agentsales_bot
toolread_crm
toolsend_external_email
Control frameworks context, not certification
NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties
SOC 2 Trust Services Criteria (2017) · CC6.3 Access modification and segregation of duties
ISO/IEC 27001:2022 · A.5.15 Access control
ISO/IEC 27001:2022 · A.5.18 Access rights
SOX ITGC · SoD Segregation of duties over financial processes
EU AI Act (Regulation (EU) 2024/1689) · Art. 14 Human oversight
Identity governance — Model-identified segregation-of-duties candidate
Delegated payment-approval blast radius
Through the delegation edge, ChiefOfStaffBot can reach the finance_bot, which directly holds the approve_payment tool. Consequently, any user or process that can invoke ChiefOfStaffBot inherits the ability to trigger payment approvals via finance_bot. The practical blast radius therefore extends to all payment transactions that finance_bot is authorized to approve, creating a critical risk of unauthorized or fraudulent payments if the delegation is not tightly controlled.
Recommended actionConduct an immediate access review of the delegation relationship between ChiefOfStaffBot and finance_bot. Restrict delegation to only verified, least‑privilege identities, enforce multi‑factor approval for payment actions, and implement monitoring/auditing of all approve_payment invocations originating from ChiefOfStaffBot.
Evidence
agentchief_of_staff_bot
delegation edgechief_of_staff_bot->finance_bot
agentfinance_bot
toolapprove_payment
Control frameworks context, not certification
NIST SP 800-53 Rev. 5 · AC-6 Least Privilege
NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties
SOC 2 Trust Services Criteria (2017) · CC6.1 Logical access security
ISO/IEC 27001:2022 · A.8.2 Privileged access rights
Identity governance — effective access review and least privilege
Delegated payment-approval blast radius
Compromise of ExecBriefingBot grants indirect access to the approve_payment tool via the delegation chain (ExecBriefingBot → chief_of_staff_bot → finance_bot). An attacker who gains control of ExecBriefingBot could approve payments without direct authorization, exposing the organization to unauthorized disbursements and potential financial loss.
Recommended actionRestrict delegation paths so that ExecBriefingBot cannot reach payment‑approval capabilities, enforce least‑privilege principles on delegation edges, conduct an immediate access review of all delegated relationships, and implement monitoring/alerting for any use of approve_payment originating from indirect agents.
Evidence
agentexec_briefing_bot
delegation edgeexec_briefing_bot->chief_of_staff_bot
delegation edgechief_of_staff_bot->finance_bot
agentfinance_bot
toolapprove_payment
Control frameworks context, not certification
NIST SP 800-53 Rev. 5 · AC-6 Least Privilege
NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties
SOC 2 Trust Services Criteria (2017) · CC6.1 Logical access security
ISO/IEC 27001:2022 · A.8.2 Privileged access rights
Identity governance — effective access review and least privilege
critical
risk 49/100
Delegation escalation
Deterministic check
summary_bot ↗
Delegated payment-approval blast radius
This agent does not hold payment approval directly, but it can reach an agent that does through delegation. Its effective access therefore includes authority to authorize disbursements, creating a confused-deputy path.
Recommended actionRemove or constrain the delegation link to the payment-approving agent. If delegation is necessary, expose a narrowly scoped workflow action rather than the delegate's general approval authority.
Evidence
agentsummary_bot
delegation edgesummary_bot->finance_bot
agentfinance_bot
toolapprove_payment
Control frameworks context, not certification
NIST SP 800-53 Rev. 5 · AC-6 Least Privilege
NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties
SOC 2 Trust Services Criteria (2017) · CC6.1 Logical access security
ISO/IEC 27001:2022 · A.8.2 Privileged access rights
Identity governance — effective access review and least privilege
high
risk 44/100
Segregation of duties
Deterministic check
access_bot ↗
Self-granting privilege path
AccessBot possesses both the request_access and grant_access capabilities, creating a self‑granting privilege path. This enables the agent to request and immediately approve access to applications without independent review, allowing unauthorized privilege escalation across the organization’s systems. The blast radius includes potential exposure of sensitive data, violation of compliance requirements, and the ability for an attacker who compromises the bot to obtain unrestricted access to any application the bot can request.
Recommended actionSegregate duties by removing the direct grant of the grant_access tool from AccessBot. Implement an approval workflow that requires a separate, privileged role to approve access requests. Apply least‑privilege principles to the agent, enforce monitoring of any grant actions, and conduct periodic reviews of agent permissions.
Evidence
agentaccess_bot
toolgrant_access
toolrequest_access
Control frameworks context, not certification
NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties
SOC 2 Trust Services Criteria (2017) · CC6.3 Access modification and segregation of duties
ISO/IEC 27001:2022 · A.5.15 Access control
ISO/IEC 27001:2022 · A.5.18 Access rights
SOX ITGC · SoD Segregation of duties over financial processes
EU AI Act (Regulation (EU) 2024/1689) · Art. 14 Human oversight
Identity governance — segregation of duties (access request versus access grant)
high
risk 30/100
Orphaned agent
Deterministic check
legacy_bot ↗
Ownerless agent has no accountable reviewer
The LegacyBot agent lacks an assigned owner, so no individual is accountable for its access rights or activity. This creates a compliance gap (missing reviewer for access certification) and increases the risk of undetected misuse or unauthorized data exposure through the agent's operations.
Recommended actionAssign a named owner in the fleet inventory, update the agent's governance record, and include the agent in the regular access certification process to ensure accountability.
Evidence
agentlegacy_bot
Control frameworks context, not certification
NIST SP 800-53 Rev. 5 · AC-2 Account Management
SOC 2 Trust Services Criteria (2017) · CC6.2 User registration and authorization
ISO/IEC 27001:2022 · A.5.16 Identity management
SOX ITGC · Access accountability Accountable ownership of access
Accountability — named owner required for agent access certification
No findings match that signal.