confidence 82%Grounded
https://vendor.example/invoice-4821.htmldocumententers_contextsavvy-cliRetrieved contextretrieved contextroutes_tosavvy-cligpt-supportmodelinvokessavvy-clirefund_customertoolcan_executellm-attack-rangerefundsaction
SecEng Evidence GraphGrounded Attack-Path Chaining
by SecEng › savvy-cli · simstudio · llm-attack-range
Fixture-driven · Support Copilot fixture
10 attack paths15 validated
Evidence assembled from 3 SecEng tools
Untrusted document → sensitive write, grounded in what SecEng actually observed
Each edge below is backed by real evidence records. Grounded steps were observed by a sensor or deterministically derived from configuration; inferred and speculative steps are drawn distinctly and never silently promoted. Analyst validation remains a human step.
12
Evidence items
3
Tools
8
Graph nodes
10
Graph edges
10
Attack paths
0
Schema errors
LegendGroundedInferredSpeculative trust boundary delegated authority
Grounded attack paths (10)
confidence 78%Grounded
https://vendor.example/invoice-4821.htmldocumententers_contextsavvy-cliRetrieved contextretrieved contextroutes_tosavvy-cligpt-supportmodelinvokessavvy-clirefund_customertoolauthorized_assavvy-cli · simstudio-whitelabelservice_account (payments:write)credential
confidence 78%Grounded
https://vendor.example/invoice-4821.htmldocumententers_contextsavvy-cliRetrieved contextretrieved contextroutes_tosavvy-cligpt-supportmodelinvokessavvy-clirefund_customertoolcan_sendsimstudio-whitelabelrefundsaction
confidence 77%Grounded
https://vendor.example/invoice-4821.htmldocumententers_contextsimstudio-whitelabelSupport agentagentcan_callsimstudio-whitelabelrefund_customertoolcan_executellm-attack-rangerefundsaction
confidence 74%Grounded
https://vendor.example/invoice-4821.htmldocumententers_contextsavvy-cliRetrieved contextretrieved contextroutes_tosavvy-cligpt-supportmodelinvokessavvy-clirefund_customertoolcan_writesavvy-clirefundsaction
confidence 74%Grounded
https://vendor.example/invoice-4821.htmldocumententers_contextsavvy-cliRetrieved contextretrieved contextroutes_tosavvy-cligpt-supportmodelinvokessavvy-clirefund_customertoolcan_readsavvy-clicustomersdatastore
confidence 73%Grounded
https://vendor.example/invoice-4821.htmldocumententers_contextsimstudio-whitelabelSupport agentagentcan_callsimstudio-whitelabelrefund_customertoolauthorized_assavvy-cli · simstudio-whitelabelservice_account (payments:write)credential
confidence 73%Grounded
https://vendor.example/invoice-4821.htmldocumententers_contextsimstudio-whitelabelSupport agentagentcan_callsimstudio-whitelabelrefund_customertoolcan_sendsimstudio-whitelabelrefundsaction
confidence 69%Grounded
https://vendor.example/invoice-4821.htmldocumententers_contextsimstudio-whitelabelSupport agentagentcan_callsimstudio-whitelabelrefund_customertoolcan_writesavvy-clirefundsaction
confidence 69%Grounded
https://vendor.example/invoice-4821.htmldocumententers_contextsimstudio-whitelabelSupport agentagentcan_callsimstudio-whitelabelrefund_customertoolcan_readsavvy-clicustomersdatastore
Chokepoints — where one control collapses many paths
Adding a mandatory approval/control at entity:tool_refund blocks 10 of 10 analyzed paths.
Greedy control cover
- 1refund_customer10/10 paths
Path frequency by node
- refund_customer10
- refunds6
- Support agent5
- Retrieved context5
- gpt-support5
- service_account (payments:write)2
- customers2
Evidence provenance — every edge traces here
| Tool | Type | Grounding | Conf. | Claim (subject → object) |
|---|---|---|---|---|
| savvy-cli | runtime.rag_chunk_enters_context | observed | 95% | entity:external_invoice —enters_context→ entity:context |
| savvy-cli | runtime.context_routes_to_model | observed | 95% | entity:context —routes_to→ entity:model |
| savvy-cli | runtime.tool_call | observed | 96% | entity:model —invokes→ entity:tool_refund |
| savvy-cli | authority.capability_auth | derived | 85% | entity:tool_refund —authorized_as→ entity:cred_payments |
| savvy-cli | authority.capability_write | derived | 85% | entity:tool_refund —can_write→ entity:action_refund_write |
| savvy-cli | authority.capability_read | derived | 85% | entity:tool_refund —can_read→ entity:datastore_customers |
| simstudio-whitelabel | authority.workflow_input_flow | derived | 90% | entity:external_invoice —enters_context→ entity:agent_support |
| simstudio-whitelabel | authority.workflow_can_call | derived | 90% | entity:agent_support —can_call→ entity:tool_refund |
| simstudio-whitelabel | authority.tool_credential | derived | 90% | entity:tool_refund —authorized_as→ entity:cred_payments |
| simstudio-whitelabel | authority.tool_write | derived | 90% | entity:tool_refund —can_send→ entity:action_refund_write |
| llm-attack-range | range.finding.demonstrated | observed | 95% | entity:tool_refund —can_execute→ entity:action_refund_write |
| llm-attack-range | range.finding.demonstrated | observed | 95% | entity:tool_refund —can_execute→ entity:action_refund_write |
Evidence Pack export — grounded paths → buyer-ready artifact
The same grounded paths, bridged into deliverable findings and controls. Machine-validated only — nothing is marked analyst-confirmed until a human signs off.
10
Findings
1
Controls
1
Recommendations
- mediumUntrusted https://vendor.example/invoice-4821.html can reach refundsopen
- criticalUntrusted https://vendor.example/invoice-4821.html can reach service_account (payments:write)open
- mediumUntrusted https://vendor.example/invoice-4821.html can reach refundsopen
- mediumUntrusted https://vendor.example/invoice-4821.html can reach refundsopen
Synthetic fixture · SecEng Evidence Graph v0.1.0 · deterministic (no LLM in the analysis path)