Part 3 of 4 · 2 min read
Exercises
Easy
Easy 1: Run it (30 minutes)
Run python -m pytest -q and python run_all.py in code/mini-privilege.
Done when: you report the worst-case damage of the three designs.
Easy 2: Audit a tool list (30 minutes)
Take a real or imagined agent with five tools.
Done when: each tool has resource, action, cap and expiry listed, or is marked "remove".
Easy 3: Find the escalation (30 minutes)
Add an edge write:deploy_key -> shell to ESCALATION.
Done when: you show which designs it affects.
Hint
the closure follows edges transitively.
Medium
Medium 1: Rate limits (3 hours)
Add a per-minute rate to grants.
Done when: worst-case damage over 10 minutes is bounded by cap times rate.
Hint
rate needs a time window and per-window counters.
Medium 2: Adaptive attacker (4 hours)
Let the attacker chain actions (read secrets, then use a credential).
Done when: you show which design stops the chain and where.
Hint
treat reading a credential as gaining a new grant.
Medium 3: Choose the cap (3 hours)
Use a refund distribution to choose the cap.
Done when: you report utility against worst-case damage for caps of 25, 50, 100 and 500.
Hard
Hard 1: Real credentials (8 hours)
Issue per-task credentials with a cloud provider's short-lived tokens. (I did not run this, so your numbers are the ground truth.)
Done when: you show a task token that cannot read a different customer's record.
Hard 2: Attenuation proof (6 hours)
Write property-based tests that any attenuated grant authorises a subset of the parent. (I did not run this.)
Done when: a random search finds no counterexample, or you fix the pattern comparison.
Hint
a hypothesis-style generator of patterns, actions and resources is enough.
Hard 3: Blast-radius report (8 hours)
Compute the worst case for a real agent. (I did not run this.)
Done when: a review accepts the report and one tool is removed as a result.