WORKBENCH EXPERIENCE · MAP + DEFEND

Agent Authority, Workflow Paths, and Control Boundaries

Trace the authority your agents and tools can actually exercise.

Authority Graph models how agents, identities, credentials, tools, permissions, approvals, data, and downstream actions compose. Import workflows, MCP servers, tool schemas, and approved identity context to identify effective authority, dangerous capability combinations, bypass routes, blast radius, and the controls required to constrain them. Primary M.A.D.E. stages: Map and Defend. Attack tests candidate abuse paths; Evidence preserves the result.

Analyze an Agent Workflow Scope Agent Hardening

WHAT CAN AGENTS ACTUALLY DO?

Authority model

Classify identities, credentials, tools, permissions, actions, effects, and scopes.

Workflow and authority graph

Show how input, agents, retrieval, tools, identities, approvals, controls, and external effects connect.

Dangerous composition

Identify combinations of access and action that create disproportionate consequence or blast radius.

Control boundaries

Show enforced, missing, bypassed, optional, and weak approval or policy boundaries.

Authority Graph

Bounded workflow fixture showing identities, tools, approvals, actions, and authority relationships

Fixture

High-risk workflows

Authority-composition summary

Tools across demo dataset

Callable tools represented in the fixture dataset

Approval coverage

68%

Approval boundary coverage

Approval bypassed

Bypassable control boundaries

Webhook

User Request

Agent

Assistant Agent

Retriever

Retrieve Documents

Crm

Read CRM

Llm

Draft Email with LLM

Authority Graph

Bounded workflow fixture showing identities, tools, approvals, actions, and authority relationships

Fixture

High-risk workflows

Authority-composition summary

Tools across demo dataset

Callable tools represented in the fixture dataset

Approval coverage

68%

Approval boundary coverage

Approval bypassed

Bypassable control boundaries

Webhook

User Request

Agent

Assistant Agent

Retriever

Retrieve Documents

Crm

Read CRM

Llm

Draft Email with LLM

Core capabilities

What Authority Graph does.

Tool and workflow inventory

Inventory agents, service identities, credentials, MCP servers, callable tools, workflow nodes, browser actions, APIs, approval gates, and downstream effects.

Authority classification

Classify what each actor or tool can read, write, delete, send, execute, administer, approve, delegate, or expose—and the scope under which it acts.

Dangerous composition analysis

Identify combinations that become risky together, including sensitive read plus external send, retrieval plus write, filesystem plus network, execution plus broad credentials, or administrator APIs controlled by model-generated arguments.

Workflow authority graph

Show how user input, agents, prompts, retrievers, tools, identities, APIs, approval gates, controls, and external actions connect.

Blast-radius analysis

Assess the consequence and reach of each authority path, including external effects, irreversible actions, administrative scope, cross-system reach, and affected data.

Approval and control analysis

Identify enforced, missing, optional, weak, or bypassable controls and determine where authority can cross a consequential boundary without adequate review.

Evidence & signals

What you get out of the box.

Tool Authority Breakdown

Read: 18
Write: 12
Send: 7
Execute: 4
Admin: 2

Approval Boundaries

Enforced: 14
Missing: 5
Bypassed: 3
Optional: 4

Dangerous Compositions

Read CRM Data + Send Email Externally — High
Retrieve Documents + Update Records — High
Access Files + External API Call — Medium

Red team + Blue team

Built for both sides of the security equation.

Adversarial planning and validation

Identify candidate abuse paths created by dangerous authority composition.
Design bounded scenarios around bypass routes, excessive scope, and consequential actions.
Test whether alternate workflow branches or instruction manipulation can evade controls.
Capture evidence that supports, constrains, or rejects the modeled path.

Architecture and hardening

Produce authority maps, control-boundary findings, scope reviews, and remediation backlogs.
Reduce permissions, split tools, constrain credentials, and add approval requirements.
Define retest conditions for workflows and authority changes.
Preserve evidence and decisions for release and assurance review.

AI SECURITY WORKBENCH

Ready to make effective agent authority reviewable?

Import one representative workflow and its tool, identity, permission, and approval context. Use Authority Graph to identify dangerous composition, bypassable controls, blast radius, and the smallest useful hardening plan.

Scope an AI Security Review See the full Workbench

Continue through the Workbench

Threat Canvas

Place authority relationships inside the wider application, trust-boundary, and flow model.

Explore

Continue through the Workbench

Tool Analyzer

Normalize callable capabilities, permissions, authentication, and side effects.

Explore

Continue through the Workbench

Agent Authority Review

Compare intended authority with effective capability and produce a hardening plan.

Explore

Continue through the Workbench

Attack Path Analysis

Combine supported authority context with findings, traces, and system evidence to qualify consequential paths.

Explore

See full Workbench

Progressive proof

Connected authority analysis, demonstrated on a bounded fixture.

The bounded fixture demonstrates how the Workbench models agents, identities, tools, approvals, data, controls, and external effects. Metrics refer only to the fixture dataset. Modeled authority paths are not automatically presented as validated attack paths.

Model effective authority, not just assigned permissions.

The graph connects identities, agents, tools, data, credentials, policies, approval gates, and consequential actions so reviewers can see who or what can reach each sensitive outcome.

AUTH-01imported graph

Authority Graph Overview

The authority graph models which identities and agents can invoke which tools, data, approvals, and consequential actions.

This turns fragmented IAM, application, agent, and workflow configuration into a reviewable topology of read, write, send, execute, approve, administer, and delegate authority.

M.A.D.E. · Map + Defend · instrument

Workflow authority result — ACME Corp fixture.

The fixture below stands in for an ACME Corp workflow import and shows how the Tauri sidecar surface operates with shared components, consistent theming, and release-ready evidence language.

ACME fixture

Authority Graph / Dashboard

Authority Graph

Analysis bundle

Map what your agents can actually do. Find dangerous compositions. Enforce approval boundaries.

Jump to graph Jump to evidence Open Runtime Trace

High-risk workflows

Derived from composition risks

Tools across demo dataset

Authority-register tools across the demo dataset

Approval coverage

68%

Approval boundary coverage

Approval bypassed

Blocked or bypassed steps

Dangerous compositions

Risk-report compositions

External effects

Send / write / external sinks

Workflow Authority Graph

The graph is organized around approval control, bypass detection, and the points where safe components become dangerous together.

Selected authority path: reviewed outbound action

InputReasoningData AccessGovernanceExternal ActionBypass / High Risk

Intake

Governance

Retrieval

Reasoning

Action

Bypass

User Request

Webhook

not_requirednetwork

request_payload

apps/web/app/api/assistant/outbound/route.ts

Assistant Agent

Agent

optionalreadexecute

customer_profileconversation_state

packages/ai/agents/outbound-assistant.ts

Retrieve Documents

Retriever

not_requiredreadsensitive

knowledge_basecustomer_context

packages/rag/retrieve-context.ts

Read CRM

Crm

optionalreadexternal

accountopportunity

packages/ai/tools/read-crm.ts

Draft Email with LLM

Llm

not_requiredreadsensitive

draft_textcustomer_context

packages/ai/prompts/outbound-email.md

Policy Check

enforcedread

policy_decision

packages/governance/policies/workflow-policy.ts

Human Approval Gate

Approval Gate

enforcedread

approval_record

packages/governance/approvals/review.ts

Send Email via Outlook

enforcedsendexternal

message_bodyrecipient

packages/ai/tools/send-outlook.ts

Update CRM Record

Api

enforcedwriteexternal

crm_recordstatus_update

packages/ai/tools/update-crm.ts

Bypass Send Branch

External Sink

bypassedsendexternal

external_actionbypass_path

packages/ai/flows/bypass-send.ts

Policy Check

Human Approval Gate

Nodes

Edges

Platform

n8n

Importer

explicit_graph

Selected authority path

reviewed outbound action

high

The branch from the draft step reaches the CRM update without passing through the human approval gate.

enforcedhigh blast radius

User RequestAssistant AgentRetrieve DocumentsDraft Email with LLMHuman Approval GateSend Email via Outlook

Connected control map

Retrieval and approval boundaries inside the workflow

This view shows where retrieval context, agent reasoning, approval coverage, control bypasses, and external effects intersect inside the workflow.

Workflow control map

Authority Graph

RAG Boundary Lens

Approval boundaries, bypass paths, and external effects rendered against the agent workflow graph.

RAG detectedClaim-ready preview

Boundary score

45/100

RAG detected

Yes

Affected retrieval flows

Top tests

AuthZ pass

Watch

amber

Approval coverage still needs hardening.

Context leaks

amber

External effect nodes stand in for potential leakage surfaces.

Policy violations

red

Bypassed approvals need follow-up.

Pipeline snapshot

Import graphMap authorityCheck approvalsScore blast radiusExport control map

Suggested tests

Bypass branch blocked before CRM updateApproval gate required before external sendAuthority chain fails closed on missing policy check

Controls found

Outbound send requires human reviewBypass branch skips human approvalPolicy check is enforced before the review gate

Affected retrieval flows

packages/rag/retrieve-context.tspackages/ai/tools/read-crm.ts

Missing boundaries

Priority gaps

Approval gate coverageBypass path quarantineExternal effect boundary

Top tests

Harness checks

1Approval gate can be bypassed before the CRM update

2Outbound send requires human review

• seceng-rag/seceng-rag.config.json

• seceng-rag/identities.json

• seceng-rag/documents.json

• seceng-rag/tests.json

The lens is public-safe and directional. It uses job-description intelligence and trace fixture signals to show where RAG boundaries need reinforcement, without exposing raw documents or private payloads.

Workflow Authority Register

Capabilities are derived from the actual authority booleans on each node.

38 tools across demo dataset

read · 14write · 8send · 6execute · 4admin · 2external · 4

Update CRM Record

Api · enforced

criticalenforced

writeexternalirreversiblesensitivenetwork

crm_recordstatus_updatecrm.write

Evidence: crm write scope · irreversible external update

Bypass Send Branch

External Sink · bypassed

criticalbypassed

sendexternalirreversiblenetwork

external_actionbypass_pathworkflow.bypass

Evidence: approval bypass · external sink path

Read CRM

Crm · optional

highoptional

readexternalsensitivenetwork

accountopportunitycontactcrm.read

Evidence: salesforce read scope · external sensitive lookup

Send Email via Outlook

Email · enforced

highenforced

sendexternalirreversiblenetwork

message_bodyrecipientmail.send

Evidence: mail send scope · external delivery

Assistant Agent

Agent · optional

mediumoptional

readexecutesensitivenetwork

customer_profileconversation_stateassistant.orchestrate

Evidence: orchestration code · decision boundary

Retrieve Documents

Retriever · not_required

mediumnot_required

readsensitivenetwork

knowledge_basecustomer_contextrag.read

Evidence: vector-store fetch · sensitive context

Draft Email with LLM

Llm · not_required

mediumnot_required

readsensitivenetwork

draft_textcustomer_contextllm.generate

Evidence: prompt assembly · customer context used

User Request

Webhook · not_required

lownot_required

network

request_payloadpublic_ingress

Evidence: POST ingress · request payload observed

Policy Check

Policy Check · enforced

lowenforced

read

policy_decisionpolicy.evaluate

Evidence: policy predicate · guarded branch

Human Approval Gate

Approval Gate · enforced

lowenforced

read

approval_recordapproval.review

Evidence: review gate · approval record

Composition Risk Stack

Candidate abuse paths

Scorecard

High risk workflows

Dangerous compositions

External effects

Approval bypasses

Approval Coverage

Coverage

68%

17 enforced · 5 missing · 3 bypassed · 0 optional

Outbound send requires human review

The primary send path is gated by a human approval step.

enforced

Severity: low

Remediation: Keep the approval record attached to the outbound message before delivery.

node_approvalnode_email

Bypass branch skips human approval

A secondary branch can route from the draft directly to the CRM update.

bypassed

Severity: critical

Remediation: Block the bypass sink until it passes through the same approval gate.

node_llmnode_bypassnode_api

Policy check is enforced before the review gate

Policy evaluation exists and is wired into the reviewed path.

enforced

Severity: low

Remediation: Keep the policy decision attached to the approval record for audit.

node_policynode_approval

CRM lookup remains unaudited in the draft path

The lookup step contributes context but does not have its own approval event.

missing

Severity: high

Remediation: Log the lookup scope and require explicit approval when sensitive account data is accessed.

node_crmnode_llm

Blast Radius

Overall: high · Score 84

high

Bypass Send Branch

node_bypass

approval_bypassedexternal_sinkirreversibleno_guardrail

Update CRM Record

node_api

writeexternalirreversiblecustomer_state

Send Email via Outlook

node_email

sendexternalcustomer_contactdelivery

Draft Email with LLM

node_llm

prompt_contextsensitive_inputsgeneration

Read CRM

node_crm

sensitiveexternalreadcustomer_profile

Retrieve Documents

node_retriever

sensitiveretrievalcontext_spill

Assistant Agent

node_agent

decisioningtool_orchestrationmulti_step_path

Policy Check

node_policy

read_onlyguardraildecision_filter

Human Approval Gate

node_approval

enforcedreview_recordhuman_in_loop

User Request

node_webhook

ingressno_actionentry_point

Security-Relevant Authority Paths

16 analyzed authority paths1 tools in this fixture16 connected evidence nodes18 supported relationships

Evidence from this surface is normalized into the connected Workbench evidence model. Each displayed step references the tool, workflow, identity, control, or fixture evidence that supports it. Observed, deterministically derived, and inferred relationships remain distinguishable.

Adding a mandatory approval/control at wf:acme-outbound-assistant-graph-v1:node_agent blocks 16 of 16 analyzed paths.

Groundedattack· conf 93%11authority-graph
User RequestAssistant AgentPolicy CheckHuman Approval GateSend Email via OutlookUpdate CRM Record
Groundedattack· conf 89%11authority-graph
User RequestAssistant AgentRetrieve DocumentsDraft Email with LLMHuman Approval GateSend Email via Outlook
Groundedattack· conf 88%22authority-graph
User RequestAssistant AgentRetrieve DocumentsDraft Email with LLMHuman Approval GateSend Email via OutlookUpdate CRM Record
Groundedattack· conf 84%12authority-graph
User RequestAssistant AgentRead CRMDraft Email with LLMHuman Approval GateSend Email via OutlookUpdate CRM Record

LegendGroundedInferredSpeculative+12 moreOpen full Evidence Graph

Threat Model

ACME outbound assistant workflow

Assets

• Customer Data · sensitive_data
• Prompt Context · context
• Approval Record · control_evidence
• Outbound Actions · external_effect

Actors

• End User · human
• Assistant Agent · workflow_agent
• Human Reviewer · human

Trust Boundaries

• Public Ingress · external_to_internal
• Sensitive Context Boundary · internal_sensitive
• Outbound Effect Boundary · external_effect

Mitigations

• Split outbound send and CRM update into separate approvals · recommended
• Guard the bypass sink with explicit policy enforcement · in_progress
• Tag source context before draft generation · recommended
• Persist the approval record alongside external effects · planned

Prompt injection steers outbound draft

Retrieved content or CRM text can alter the draft email instructions.

high

policy_checkapproval_gatecontent_normalization

Approval bypass reaches CRM update

The bypass sink reaches the CRM write path without human review.

critical

approval_gatepolicy_checkaudit_log

Outbound send exceeds intended scope

The same workflow can compose email send and CRM update, widening the blast radius.

high

least_privilegescoped_approvalboundary_split

Policy check does not cover the bypass branch

The policy gate protects the reviewed path but does not currently stop the bypass sink.

medium

policy_enforcementbranch_blockingpath_diffing

Evidence

graph_snapshot

Normalized graph snapshot for ACME outbound assistant workflow.

sha256:cc9a6b6e0a9f3c8f4baf1a2b90c1b1c7d8f3f0f8c83c8f70b06d8fef2c28a1f4

approval_record

Human review attached to the primary send path.

sha256:5f7b4f3f0a7dbeed5d68e0d3f8b9d6b4de2ccaf6f6c0c1f3f5a7c5b6d8e2c1a9

abuse_path

Bypass branch observed from draft step to CRM update.

sha256:9b1e0d4cf8d2cde2c1d0f3f0a7b1e5d7c2f8c0e1d6b5a8c9f4e3d2c1b0a9f8e7

Export Artifacts

Copy or download the bundle outputs without leaving the page.

graph_json

acme-outbound-assistant-graph.json

application/json

{
  "graph": {
    "graph_id": "acme-outbound-assistant-graph-v1",
    "name": "ACME outbound assistant workflow",
    "source": {
      "platform": "n8n",
      "source_uri": "https://n8n.acme.local/workflows/outbound-assistant",
      "importer": "workflow-import-normalizer"
    }
  },
  "scorecard": {
    "high_risk_workflows": 7,
    "dangerous_compositions": 4,
    "external_effects": 5,
    "irreversible_actions": 3,
    "approval_bypasses": 3
  }
}

authority_register_json

acme-workflow-authority-register.json

application/json

{
  "graph_id": "acme-outbound-assistant-graph-v1",
  "tools_discovered": 38
}

threat_model_json

acme-workflow-threat-model.json

application/json

{
  "graph_id": "acme-outbound-assistant-graph-v1",
  "title": "ACME outbound assistant workflow"
}

export_manifest_md

acme-workflow-analysis.md

text/markdown

# ACME outbound assistant workflow

- High-risk workflows: 7
- Tools discovered: 38
- Approval coverage: 68%
- Approval bypasses: 3

When an authority path becomes an attack-path candidate

Authority Graph establishes who or what can act, through which identity, with which tool, under which control, and toward which consequence. Attack Path Analysis combines that authority context with findings, runtime traces, system evidence, and validated preconditions before calling a route a grounded or validated attack path.

Authority path — effective capability and reach
Candidate abuse path — plausible misuse requiring validation
Supported attack path — material relationships are supported by system-specific evidence
Validated attack path — sequence and consequence independently tested or demonstrated

Individually reasonable permissions can compose into unsafe authority.

A system may appear constrained when each permission is reviewed separately. Risk emerges when an agent can combine retrieval, credentials, tools, delegated identity, and downstream actions into an end-to-end path.

AUTH-02imported graph

Unsafe Authority Composition

Individually reasonable permissions can combine into a dangerous end-to-end authority path.

The graph exposes these composed paths before they become an incident, allowing reviewers to distinguish ordinary access from authority that can cross trust boundaries or create irreversible effects.

Recommendations preserve evidence and ownership.

Least-privilege, approval, credential-scope, and separation-of-duties recommendations record their configuration basis, confidence, inferred reachability, and responsible remediation owner before they become control decisions.

Break several authority paths with one well-placed control.

The highest-value remediation is often not another detector. It is the approval gate, permission boundary, credential scope, action limit, or separation-of-duties control shared by several dangerous paths.

AUTH-03

Authority to Control Chokepoint

A small change to permission, approval, or action scope can break several unsafe authority paths.

Path blockedReduced, not eliminatedPending retest

Chokepoint analysis helps product, platform, identity, and security teams prioritize controls that materially reduce reachable impact rather than merely shrinking isolated permission lists.

Delivery & licensing

Available through the model that fits the product outcome.

Expert-led engagement

We map agent authority directly and deliver hardening recommendations as part of an assessment.

Bounded partner pilot

One imported workflow, MCP server, or tool schema set is mapped and returned as an authority graph.

OEM or licensed capability

The authority-mapping and chokepoint-analysis engine can operate behind a partner's own agent, IAM, or workflow platform.

Accepts

Workflow definitions, MCP server manifests, and tool schemas.

Returns

An authority graph, security-relevant authority paths, least-privilege recommendations, control-boundary findings, and remediation chokepoints.

Current maturity

Fixture-tested

Explore Offensive Security Platforms