Part 1 of 4 · 1 min read
Overview
Module 1 says assume the model will sometimes obey an attacker. This module decides how bad that is. Interviewers ask "what is the blast radius if your agent is compromised?" and expect a number or a bound, not "we told it not to".
About the example, and what is real
Real: the grant model (glob resources, actions, amount caps, expiry, use counts), deny-by-default authorisation, attenuation that refuses to broaden, the escalation closure, the worst-case and random compromise calculations and the 17 tests in code/mini-privilege. Assumed: the 28-action catalog and its damage numbers (1 unit about one currency unit), the attacker asking for 5,000, then 500, then 50 on money actions, 20 attempts, the escalation edges, and the legitimate mix (70 percent lookups, 20 percent refunds of 5 to 120, 10 percent internal email). Not real: no cloud IAM, OAuth scopes or secrets manager was used; resource matching is simple globbing (attenuation compares patterns approximately).