AI Agent Permission Auditor
Upload a permission policy to visualize what your agent can access, detect privilege escalation paths, and export a risk assessment. No data leaves your browser.
Access Graph
No policy loaded
Upload a JSON file, paste a policy, or click Load Medicare portal sample to see the auditor in action.Risk Findings
How it works
Permission policy format
The tool expects a JSON object with an agent name and a permissions array. Each permission entry defines a resource identifier, an actions array (e.g., ["read","write","admin"]), and optional conditions. Resources can use dot notation to imply hierarchy (e.g., medicare.stats.reports is a child of medicare.stats).
Risk detection logic
The auditor flags three risk classes: Broad permissions — resources granted admin or * actions; Privilege escalation — paths where write access to a parent resource implies control over children (e.g., write to medicare.config could modify medicare.stats.portal); Cross-domain reach — agents with permissions spanning unrelated services (e.g., both medicare.* and tax.*). The Risk Threshold control adjusts sensitivity.
Graph interaction
Drag nodes to rearrange. Hover a node to highlight its direct connections. Click a node to lock focus and see its granted actions in the findings panel. The graph uses a force-directed layout (Cytoscape.js cose) so structure reflects permission relationships.
Export report
The Export Risk Report button downloads a JSON file containing: the original policy, a summary of nodes/edges, every finding with severity and affected resources, and a computed risk score (0–100). This report is generated client-side; no data is transmitted.
Medicare portal sample
The sample policy models the incident reported by PM Albanese: an OpenAI agent granted read, write, and admin on medicare.stats.portal, plus read on medicare.config — creating an escalation path where config write could redirect the portal. It also includes unrelated tax.records access demonstrating cross-domain reach.
Privacy & limits
All analysis runs in your browser. Policies never leave the page. Large policies (500+ permissions) may slow layout; consider splitting by domain. The tool does not evaluate runtime behavior — only static permission structure.
Mapping Privilege Escalation in Agent Permission Graphs
Read the explanation
AI Agent Permission Auditor parses security policies into graph structures, streaming granted action verbs directly toward targeted cloud endpoints. When policies grant excessive verbs or admin access, the edge turns critical and expands the resource boundary to signal heightened risk. If a write privilege exists on a root configuration, the auditor draws a transversal escalation path, updates the risk score, and enables client-side export.
AI Agent Permission Graph & Static Access Analysis
How does static structural analysis detect privilege escalation paths in AI agent permission policies?
This auditor performs client-side static analysis on JSON access policies by modeling agents and targeted resources as a directed graph. It maps resources using dot-delimited hierarchy strings, flagging resources with administrative wildcards ('admin' or '*') as high risk and linking parent configuration resources to child services to identify potential privilege escalation paths.
Analysis is strictly static and heuristic-based. The tool matches explicit action strings and dot-separated naming patterns; it does not evaluate live cloud IAM policies, OAuth token scopes, actual tool execution sandboxes, or prompt injection vulnerabilities.
Try a worked example
Inspect the default policy in the text area containing six resource declarations. Clicking 'Reset' clears the text editor and resets internal graph state. Supplying a resource such as 'medicare.config' with write permissions alongside child resources like 'medicare.stats.portal' causes the graph generator to flag structural transversal risks where modifying root settings could influence nested subsystems.
Hierarchical Traversal & Risk Scoring Mechanics
The engine constructs a Cytoscape.js model where the agent connects to each declared resource node. When an action array includes administrative or wildcard actions, or when a write-capable parent prefix matches a downstream resource, the tool injects escalation edge definitions into the graph dataset.
Heuristic risk scoring computes a composite score capped at 100 by weighting detected danger findings at 25 points each and warnings at 10 points each, purely reflecting string-level rules rather than verified runtime execution security.