Steward Agent blast-radius intelligence
← Back to findings
Agent access certification

SummaryBot

Reads approved internal knowledge and produces concise leadership summaries.

Risk tier critical 1 verified finding
Identitysummary_bot
Owner
Avery Thompson, Executive Operations
Review state
pending
Effective accessDirect + delegated
  • approve_payment via delegation
  • read_knowledge_base direct grant
Granted vs. NeededLLM-assisted signal

Declared need

  • creates concise summary of supplied document
  • searches and reads approved internal knowledge articles

Concrete grant gap

  • approve_payment
Cited findings

Why this card needs attention

critical risk 49/100 Delegation escalation Deterministic check

Delegated payment-approval blast radius

This agent does not hold payment approval directly, but it can reach an agent that does through delegation. Its effective access therefore includes authority to authorize disbursements, creating a confused-deputy path.

Recommended actionRemove or constrain the delegation link to the payment-approving agent. If delegation is necessary, expose a narrowly scoped workflow action rather than the delegate's general approval authority.
Evidence agentsummary_bot delegation edgesummary_bot->finance_bot agentfinance_bot toolapprove_payment
Grounded MCP context not graph evidence MCP02:2025 · Privilege Escalation via Scope Creep Invariant Labs GitHub MCP toxic agent flow 26 May 2025
Control frameworks context, not certification NIST SP 800-53 Rev. 5 · AC-6 Least Privilege NIST SP 800-53 Rev. 5 · AC-5 Separation of Duties SOC 2 Trust Services Criteria (2017) · CC6.1 Logical access security ISO/IEC 27001:2022 · A.8.2 Privileged access rights
Identity governance — effective access review and least privilege