Steward Agent blast-radius intelligence
← Dashboard
Agentic identity governance

Fleet audit report

Effective access, segregation of duties, least privilege, and accountable ownership—backed by graph entities, not guesses.

Generated 2026-07-26T06:08:46.699834+00:00 · Steward schema 0.1
Fleet scope30 agents34 tools · 3 delegation edges
Verified findings106 critical-risk agents
Certification queue30 pendingReview each agent risk card
Framework coverage15 controls5 published frameworks · context, not certification
Executive summary

Top risks by composite score

Ranked by Steward's deterministic risk score — reproducible on every run, so the board sees the same ordering the auditor can recompute.

  1. support_bot — Critical data-exfiltration path risk 64/100
  2. report_bot — Unused standing access: 2 direct grants risk 58/100
  3. invoice_bot — Critical fraud path: create vendor and approve payment risk 54/100
  4. payroll_bot — Critical ghost-employee fraud path risk 54/100
  5. sales_bot — AI-generalized toxic capability combination: Read CRM account context + Send email outside the company risk 54/100
Documented MCP threat context

Authentication and token protection

MCP01 authentication and token-replay context (not a Steward finding)

This is context only, not a Steward finding or evidence that the loaded fleet has a token issue.

MCP01:2025 · Token Mismanagement & Secret Exposure

CVE-2026-32211 — Azure MCP Server missing authentication · NVD published 2 Apr 2026

NVD records missing authentication for a critical Azure MCP Server function. Microsoft, the CNA, assigned CVSS 3.1 9.1 Critical; NVD's own score is 7.5 High. Token replay is a related MCP01 concern, but this CVE record specifically describes missing authentication—not token replay.

Model provenance

Optional model enrichment

Recorded enrichment result cached live OpenAI gpt-oss-120b Bedrock result

This analysis replays recorded enrichment metadata. Inspect the provenance note before treating it as a live model run.

Completion: 34/34 tools classified

Disclosure: This zero-key cache was produced from a real OpenAI gpt-oss-120b Amazon Bedrock analysis of the committed synthetic fleet. Dashboard replay never calls Bedrock.

Finding narratives ok 9 grounded narratives
Needed-access inference ok
Tool classification ok 34/34 tools classified
Toxic-combination reasoning ok 26/26 agents analyzed · 1 new cited finding
Scope and data discipline

What was analyzed

Agent configuration metadata: grants, declared purpose, ownership, usage, and delegation. No agent payload data was analyzed.

Control language

Finding-to-control mapping

SignalControl mappingFindingsHighest risk
Delegation escalationDelegated authority — confused-deputy control3critical
Orphaned agentAccountability — named ownership1high
Over-privilegeLeast privilege — periodic access certification1high
Segregation of dutiesSOX ITGC — segregation of duties5critical
Framework coverage

Control-framework coverage matrix

Findings mapped to published control frameworks (versions cited). This matrix is auditor context — it is not a compliance certification.

FrameworkControlNameFindingsSignals
EU AI Act (Regulation (EU) 2024/1689) Art. 14 Human oversight 5 sod
ISO/IEC 27001:2022 A.5.15 Access control 5 sod
ISO/IEC 27001:2022 A.5.16 Identity management 1 orphan
ISO/IEC 27001:2022 A.5.18 Access rights 6 over_privilege, sod
ISO/IEC 27001:2022 A.8.2 Privileged access rights 4 escalation, over_privilege
NIST SP 800-53 Rev. 5 AC-2 Account Management 1 orphan
NIST SP 800-53 Rev. 5 AC-5 Separation of Duties 8 escalation, sod
NIST SP 800-53 Rev. 5 AC-6 Least Privilege 3 escalation
NIST SP 800-53 Rev. 5 AC-6 / AC-6(1) Least Privilege / Authorize Access to Security Functions 1 over_privilege
SOC 2 Trust Services Criteria (2017) CC6.1 Logical access security 4 escalation, over_privilege
SOC 2 Trust Services Criteria (2017) CC6.2 User registration and authorization 1 orphan
SOC 2 Trust Services Criteria (2017) CC6.3 Access modification and segregation of duties 6 over_privilege, sod
SOX ITGC Access accountability Accountable ownership of access 1 orphan
SOX ITGC Least privilege Least-privilege provisioning 1 over_privilege
SOX ITGC SoD Segregation of duties over financial processes 5 sod

The governance process itself (signed audit ledger, certification queue) speaks to: EU AI Act (Regulation (EU) 2024/1689) Art. 12 (Record-keeping); NIST SP 800-53 Rev. 5 AU-2 (Event Logging); NIST SP 800-53 Rev. 5 AU-6 (Audit Record Review, Analysis, and Reporting); NIST SP 800-53 Rev. 5 AC-2 (Account Management (review)); ISO/IEC 27001:2022 A.8.15 (Logging).

Peer analytics

Peer-group outliers

1 agent(s) hold access unlike any peer. Indicative on a small fleet, not statistical: a legitimately unique role looks the same as a mistake. Heuristic, not a finding — Jaccard similarity of effective access sets, threshold 0.3, 30 agents considered.

AgentEffective toolsHigh-impactMax peer similarityWhy flagged
report_bot 3 2 0.25 (bi_bot) Holds 3 effective tools (2 high-impact: delete_records, export_data), but overlaps at most 25% with any peer (closest: bi_bot) — an access profile unlike the rest of the fleet, worth a look for over-grant.
Verified findings

Evidence trail and remediation

critical risk 64/100 Segregation of duties Deterministic check support_bot ↗

Critical data-exfiltration path

SupportBot can read customer PII and directly send external email, creating a direct path for confidential customer data to be exfiltrated outside the organization, exposing the firm to regulatory violations, financial penalties, and reputational harm.

Recommended actionRevoke the direct read_customer_pii and send_external_email grants from SupportBot; implement least‑privilege controls, require mediated approval for external egress, and add monitoring/auditing of any PII access and outbound email activity.
Evidenceagentsupport_bottoolread_customer_piitoolsend_external_email
Control frameworks context, not certification NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties SOC 2 Trust Services Criteria (2017) · CC6.3 Access modification and segregation of duties ISO/IEC 27001:2022 · A.5.15 Access control ISO/IEC 27001:2022 · A.5.18 Access rights SOX ITGC · SoD Segregation of duties over financial processes EU AI Act (Regulation (EU) 2024/1689) · Art. 14 Human oversight
Data protection — least privilege and controlled external egress
high risk 58/100 Over-privilege Deterministic check report_bot ↗

Unused standing access: 2 direct grants

ReportBot holds standing privileges to delete records and export data that are never exercised. If the agent were compromised or misused, an attacker could invoke these unused grants to irreversibly remove critical data or exfiltrate sensitive information, exposing the organization to data loss, regulatory non‑compliance, and reputational damage.

Recommended actionRevoke the unnecessary delete_records and export_data grants from ReportBot and re‑certify its access against the principle of least privilege. Implement periodic review of granted versus used permissions for all agents.
Evidenceagentreport_bottooldelete_recordstoolexport_data
Control frameworks context, not certification NIST SP 800-53 Rev. 5 · AC-6 / AC-6(1) Least Privilege / Authorize Access to Security Functions SOC 2 Trust Services Criteria (2017) · CC6.1 Logical access security SOC 2 Trust Services Criteria (2017) · CC6.3 Access modification and segregation of duties ISO/IEC 27001:2022 · A.8.2 Privileged access rights ISO/IEC 27001:2022 · A.5.18 Access rights SOX ITGC · Least privilege Least-privilege provisioning
Least privilege — access certification using granted versus used access
critical risk 54/100 Segregation of duties Deterministic check invoice_bot ↗

Critical fraud path: create vendor and approve payment

InvoiceBot possesses both the create_vendor and approve_payment tool grants, giving a single automated agent the ability to add new vendors and subsequently authorize payments to those vendors. This concentration of authority creates a direct fraud pathway that could be exploited to generate fictitious vendors and approve unauthorized disbursements, potentially resulting in material financial loss and SOX compliance violations across the entire accounts‑payable function.

Recommended actionImplement segregation of duties by revoking either the create_vendor or approve_payment grant from InvoiceBot, enforce dual‑approval controls for vendor creation and payment authorization, and add continuous monitoring to detect any instance where a single entity performs both actions.
Evidenceagentinvoice_bottoolapprove_paymenttoolcreate_vendor
Control frameworks context, not certification NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties SOC 2 Trust Services Criteria (2017) · CC6.3 Access modification and segregation of duties ISO/IEC 27001:2022 · A.5.15 Access control ISO/IEC 27001:2022 · A.5.18 Access rights SOX ITGC · SoD Segregation of duties over financial processes EU AI Act (Regulation (EU) 2024/1689) · Art. 14 Human oversight
SOX ITGC — segregation of duties (vendor creation versus payment approval)
critical risk 54/100 Segregation of duties Deterministic check payroll_bot ↗

Critical ghost-employee fraud path

PayrollBot holds direct authority to both add_employee (employee creation) and run_payroll (payroll execution). This conflation of employee setup and payroll processing creates a critical segregation‑of‑duties violation, enabling a malicious or compromised bot to create ghost employees and issue unauthorized payroll payments, potentially resulting in financial loss, regulatory non‑compliance, and reputational harm across the entire payroll function.

Recommended actionRe‑engineer the permission model to enforce segregation of duties: remove the direct add_employee grant from PayrollBot, require an independent approval workflow for employee creation, and limit payroll execution to a separate, controlled role. Implement least‑privilege access, periodic access reviews, and monitoring of employee‑creation and payroll‑run activities.
Evidenceagentpayroll_bottooladd_employeetoolrun_payroll
Control frameworks context, not certification NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties SOC 2 Trust Services Criteria (2017) · CC6.3 Access modification and segregation of duties ISO/IEC 27001:2022 · A.5.15 Access control ISO/IEC 27001:2022 · A.5.18 Access rights SOX ITGC · SoD Segregation of duties over financial processes EU AI Act (Regulation (EU) 2024/1689) · Art. 14 Human oversight
SOX ITGC — segregation of duties (employee setup versus payroll execution)
high risk 54/100 Segregation of duties LLM-generalized sales_bot ↗

AI-generalized toxic capability combination: Read CRM account context + Send email outside the company

The SalesBot agent can both read CRM account context and send email outside the company, creating a direct path to expose customer information to external recipients. This combination can lead to unauthorized data disclosure, regulatory non‑compliance, reputational damage, and potential financial loss.

Recommended actionSeparate the read_crm and send_external_email permissions, enforce a dual‑approval workflow for any external email that includes CRM data, and implement continuous monitoring and audit of combined usage.
Evidenceagentsales_bottoolread_crmtoolsend_external_email
Control frameworks context, not certification NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties SOC 2 Trust Services Criteria (2017) · CC6.3 Access modification and segregation of duties ISO/IEC 27001:2022 · A.5.15 Access control ISO/IEC 27001:2022 · A.5.18 Access rights SOX ITGC · SoD Segregation of duties over financial processes EU AI Act (Regulation (EU) 2024/1689) · Art. 14 Human oversight
Identity governance — Model-identified segregation-of-duties candidate
critical risk 49/100 Delegation escalation Deterministic check chief_of_staff_bot ↗

Delegated payment-approval blast radius

Through the delegation edge, ChiefOfStaffBot can reach the finance_bot, which directly holds the approve_payment tool. Consequently, any user or process that can invoke ChiefOfStaffBot inherits the ability to trigger payment approvals via finance_bot. The practical blast radius therefore extends to all payment transactions that finance_bot is authorized to approve, creating a critical risk of unauthorized or fraudulent payments if the delegation is not tightly controlled.

Recommended actionConduct an immediate access review of the delegation relationship between ChiefOfStaffBot and finance_bot. Restrict delegation to only verified, least‑privilege identities, enforce multi‑factor approval for payment actions, and implement monitoring/auditing of all approve_payment invocations originating from ChiefOfStaffBot.
Evidenceagentchief_of_staff_botdelegation edgechief_of_staff_bot->finance_botagentfinance_bottoolapprove_payment
Control frameworks context, not certification NIST SP 800-53 Rev. 5 · AC-6 Least Privilege NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties SOC 2 Trust Services Criteria (2017) · CC6.1 Logical access security ISO/IEC 27001:2022 · A.8.2 Privileged access rights
Identity governance — effective access review and least privilege
critical risk 49/100 Delegation escalation Deterministic check exec_briefing_bot ↗

Delegated payment-approval blast radius

Compromise of ExecBriefingBot grants indirect access to the approve_payment tool via the delegation chain (ExecBriefingBot → chief_of_staff_bot → finance_bot). An attacker who gains control of ExecBriefingBot could approve payments without direct authorization, exposing the organization to unauthorized disbursements and potential financial loss.

Recommended actionRestrict delegation paths so that ExecBriefingBot cannot reach payment‑approval capabilities, enforce least‑privilege principles on delegation edges, conduct an immediate access review of all delegated relationships, and implement monitoring/alerting for any use of approve_payment originating from indirect agents.
Evidenceagentexec_briefing_botdelegation edgeexec_briefing_bot->chief_of_staff_botdelegation edgechief_of_staff_bot->finance_botagentfinance_bottoolapprove_payment
Control frameworks context, not certification NIST SP 800-53 Rev. 5 · AC-6 Least Privilege NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties SOC 2 Trust Services Criteria (2017) · CC6.1 Logical access security ISO/IEC 27001:2022 · A.8.2 Privileged access rights
Identity governance — effective access review and least privilege
critical risk 49/100 Delegation escalation Deterministic check summary_bot ↗

Delegated payment-approval blast radius

This agent does not hold payment approval directly, but it can reach an agent that does through delegation. Its effective access therefore includes authority to authorize disbursements, creating a confused-deputy path.

Recommended actionRemove or constrain the delegation link to the payment-approving agent. If delegation is necessary, expose a narrowly scoped workflow action rather than the delegate's general approval authority.
Evidenceagentsummary_botdelegation edgesummary_bot->finance_botagentfinance_bottoolapprove_payment
Control frameworks context, not certification NIST SP 800-53 Rev. 5 · AC-6 Least Privilege NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties SOC 2 Trust Services Criteria (2017) · CC6.1 Logical access security ISO/IEC 27001:2022 · A.8.2 Privileged access rights
Identity governance — effective access review and least privilege
high risk 44/100 Segregation of duties Deterministic check access_bot ↗

Self-granting privilege path

AccessBot possesses both the request_access and grant_access capabilities, creating a self‑granting privilege path. This enables the agent to request and immediately approve access to applications without independent review, allowing unauthorized privilege escalation across the organization’s systems. The blast radius includes potential exposure of sensitive data, violation of compliance requirements, and the ability for an attacker who compromises the bot to obtain unrestricted access to any application the bot can request.

Recommended actionSegregate duties by removing the direct grant of the grant_access tool from AccessBot. Implement an approval workflow that requires a separate, privileged role to approve access requests. Apply least‑privilege principles to the agent, enforce monitoring of any grant actions, and conduct periodic reviews of agent permissions.
Evidenceagentaccess_bottoolgrant_accesstoolrequest_access
Control frameworks context, not certification NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties SOC 2 Trust Services Criteria (2017) · CC6.3 Access modification and segregation of duties ISO/IEC 27001:2022 · A.5.15 Access control ISO/IEC 27001:2022 · A.5.18 Access rights SOX ITGC · SoD Segregation of duties over financial processes EU AI Act (Regulation (EU) 2024/1689) · Art. 14 Human oversight
Identity governance — segregation of duties (access request versus access grant)
high risk 30/100 Orphaned agent Deterministic check legacy_bot ↗

Ownerless agent has no accountable reviewer

The LegacyBot agent lacks an assigned owner, so no individual is accountable for its access rights or activity. This creates a compliance gap (missing reviewer for access certification) and increases the risk of undetected misuse or unauthorized data exposure through the agent's operations.

Recommended actionAssign a named owner in the fleet inventory, update the agent's governance record, and include the agent in the regular access certification process to ensure accountability.
Evidenceagentlegacy_bot
Control frameworks context, not certification NIST SP 800-53 Rev. 5 · AC-2 Account Management SOC 2 Trust Services Criteria (2017) · CC6.2 User registration and authorization ISO/IEC 27001:2022 · A.5.16 Identity management SOX ITGC · Access accountability Accountable ownership of access
Accountability — named owner required for agent access certification
Access certification

Reviewer queue

Export JSON →
AgentOwnerRisk tierFindingsReview
SupportBotsupport_bot Elena Rodriguez, Customer Support critical 1 pending
ReportBotreport_bot Noah Williams, Analytics high 1 pending
InvoiceBotinvoice_bot Maya Chen, Finance Operations critical 1 pending
PayrollBotpayroll_bot Jordan Ellis, People Operations critical 1 pending
SalesBotsales_bot Talia Brooks, Revenue Operations high 1 pending
ChiefOfStaffBotchief_of_staff_bot Avery Thompson, Executive Operations critical 1 pending
ExecBriefingBotexec_briefing_bot Avery Thompson, Executive Operations critical 1 pending
SummaryBotsummary_bot Avery Thompson, Executive Operations critical 1 pending
AccessBotaccess_bot Priya Nair, IT Identity high 1 pending
LegacyBotlegacy_bot Unassigned high 1 pending
BusinessIntelligenceBotbi_bot Noah Williams, Analytics clear 0 pending
ComplianceBotcompliance_bot Grace Kim, Risk and Compliance clear 0 pending
ContractBotcontract_bot Riley Foster, Legal Operations clear 0 pending
CustomerSuccessBotcustomer_success_bot Nina Alvarez, Customer Success clear 0 pending
DataQualityBotdata_quality_bot Noah Williams, Analytics clear 0 pending
EngineeringBotengineering_bot Ishan Kapoor, Engineering Productivity clear 0 pending
FacilitiesBotfacilities_bot Morgan Lee, Workplace Services clear 0 pending
FinanceBotfinance_bot Maya Chen, Finance Operations clear 0 pending
InventoryBotinventory_bot Diego Morales, Supply Chain clear 0 pending
KnowledgeBotknowledge_bot Samir Patel, Internal Enablement clear 0 pending
MarketingBotmarketing_bot Owen Bennett, Marketing clear 0 pending
MonitoringBotmonitoring_bot Harper Davis, Site Reliability clear 0 pending
OnboardingBotonboarding_bot Jordan Ellis, People Operations clear 0 pending
ProcurementBotprocurement_bot Dana Vasquez, Procurement clear 0 pending
RecruitingBotrecruiting_bot Jordan Ellis, People Operations clear 0 pending
ResearchBotresearch_bot Lena Okafor, Strategy clear 0 pending
SalesAssistBotsales_assist_bot Talia Brooks, Revenue Operations clear 0 pending
SchedulerBotscheduler_bot Avery Thompson, Executive Operations clear 0 pending
SecOpsBotsecops_bot Harper Davis, Site Reliability clear 0 pending
TravelBottravel_bot Morgan Lee, Workplace Services clear 0 pending