Upload a permission policy to visualize agent access, detect privilege escalation paths, and assess breach risk. Runs locally in your browser.
No policy loaded. Upload a JSON file, paste a policy, or load the sample.
This tool models AI agent permissions as a directed graph. Agents connect to resources through granted actions. The analyzer detects paths where an agent can reach resources above its clearance — privilege escalation paths that represent breach risk.
agents: Array of { id, name, role, clearance? } — clearance is a classification key (default: internal).
resources: Array of { id, name, classification } — classification must match a key in classifications.
permissions: Array of { agent, resource, actions[] } — actions are informational; any permission grants access.
classifications: Object mapping classification name → numeric level (higher = more sensitive).
The analyzer builds a bipartite graph (agents ↔ resources). An escalation path exists when an agent can reach a resource whose classification level exceeds the agent's clearance. Paths are traced through shared resources — if Agent A accesses Resource X, and Agent B also accesses Resource X, Agent A may indirectly inherit Agent B's other permissions.
The sample models a government data portal with three agents (analyst, contractor, admin), five resources at varying classifications, and cross-agent resource sharing that creates escalation paths. Load it to see the analyzer in action.
Risk report: Human-readable text summary with findings, statistics, and recommendations.
Graph JSON: Machine-readable graph with nodes, edges, and computed escalation paths for further tooling.
How does bipartite graph traversal evaluate indirect access paths and privilege escalation risks across multi-agent permission policies?
This browser-based analyzer parses an access policy JSON into a bipartite network of agent and resource nodes connected by assigned permission edges. For each agent, breadth-first search traverses adjacent links across intermediate nodes. When a path reaches a resource whose assigned classification tier exceeds that agent's clearance level, the analyzer flags an indirect privilege escalation route and highlights it on the interactive force graph.
The implementation treats all declared permissions as undirected, bidirectional traversal bridges regardless of specific action attributes like 'read', 'write', or 'delete'. In production systems, read-only access does not permit writing code or commanding co-located services. Furthermore, linear classification ranks simplify real-world attribute-based policies, which depend on environmental predicates, session attenuation, cryptographic verification, and runtime guardrails.
Click 'Load sample policy' to populate the policy textarea with three agents and five resources, then click 'Analyze permissions'. The analyzer constructs 8 nodes and 7 edges, running breadth-first search from each agent. It reports 6 escalation paths (4 critical reaching restricted resources, and 2 high reaching confidential records): DataAnalyst (clearance 1) transits through shared Internal Wiki (res-2) to reach HR Records, Citizen Database, and Audit Logs, while ContractorBot (clearance 1) directly accesses HR Records and transits through AdminAgent to reach Citizen Database and Audit Logs.
Formal access control frameworks evaluate subject attributes (such as roles and security clearances) against object attributes (such as data classifications) under specified operations and contextual rules. NIST SP 800-162 defines attribute-based access control (ABAC) as an authorization methodology where operations are governed by evaluating rules and relationships across subject, object, requested operations, and environmental attributes. NIST SP 800-162: Guide to Attribute Based Access Control (ABAC) Definition and Considerations
This client-side tool maps subject clearances and object classifications to integer levels. By running breadth-first search over connected nodes, it checks whether an agent can reach an object whose classification level exceeds the agent's baseline clearance via shared bridges.
In multi-agent architectures, automated agents handle tasks across diverse APIs and shared datastores. Industry security projects, including the OWASP Top 10 for Large Language Model Applications and GenAI Security Project, focus on risks such as excessive agency and unintended downstream execution when agents possess broad connectivity or indirect bridging across systems. OWASP Top 10 for Large Language Model Applications
While this tool models lateral inheritance as graph paths where shared resource access implies full downstream command propagation, enterprise defenses require isolating agent environments, validating provenance across agent handoffs, and strictly enforcing the principle of least privilege.
Defines attribute-based access control (ABAC) and the evaluation of subject attributes against object attributes and requested operations.
Documents risks in generative AI and agentic systems, including excessive agency and vulnerabilities arising from multi-system tool integration.
Load the sample policy, then Analyze. The source constructs three agents, five resources, and seven permission edges. Every edge is traversed in both directions. Starting from the level one Data Analyst, breadth first search crosses the Internal Wiki to Contractor Bot, then to level two HR Records. That is three edges. Because the resource level exceeds the starting clearance, the path becomes a finding. This is the analyzer’s graph rule, not proof that a real identity can inherit another agent’s authority. Both internal agents can reach HR, Citizen Database, and Audit Logs through the shared component. That makes three findings per internal agent and six overall. Citizen and Audit each contribute one finding for each agent, giving four critical findings. HR contributes two high findings. The restricted Admin Agent starts at level three, so it contributes none. The visited set is reset for each starting agent and records one visited route per resource, rather than enumerating every possible route. The policy retains read, write, and delete action names on edges, but the search loop reads only the target. It does not require a write action, impersonation capability, credential transfer, or a demonstrated exploit. Treat the red paths as candidates for investigation. A real access review must check effective authorization separately. Changing classifications or removing a shared edge changes the graph calculation; this page does not modify a live permission system. Paste JSON or use a local file. The validator checks the arrays, referenced agent and resource identifiers, and classification names before analysis. Report and graph exports serialize local results; they are not certificates of safe access. The canvas relies on D three being available. The offline preservation test blocks remote requests and therefore cannot demonstrate the real graph rendering library here. The animation you are watching is separately authored from the source calculation, while the original tool and its listeners remain unchanged.