An agent with a valid identity can still have the wrong authority

A user can authenticate correctly, an agent can hold a real enterprise identity, and an access-controlled database can reject an unauthorized query, yet the final answer or tool action can still cross the wrong permission boundary. Recent disclosures locate the mistake at five different stages: creating identities, mapping roles, assembling retrieval context, sharing concurrent index state and caching output.

These are not five stages of a single intrusion. They are independent defects showing why a credential, an ACL and a successful login cannot stand in for an end-to-end permission proof.

Proofpoint's agent-blueprint demonstration used a consented multi-tenant manager capable of creating child agent identities. The reported platform limit of up to 250 child identities describes a capability under the applicable configuration, not the number of malicious agents found in a victim tenant. Consent to one visible application can therefore authorize a mechanism that issues many additional principals. Investigators need to trace each created identity, granted scope and revocation event; deleting a visible parent registration is not, by itself, a receipt that previously issued authority has disappeared.

The registry defect required no imaginary identity at all. A real low-privilege caller could modify the registry's own permission mapping to include an administrative group. The separate upstream-URL vulnerability then reminds us that the same product can fail at a network boundary without relying on that first flaw. The two advisories have separate prerequisites and fixes. Combining their theoretical effects into one demonstrated attacker chain would overstate the available evidence.

An Auth0 FGA decision may correctly describe which object a user can access, but a document adapter still has to preserve the user, relation and conditions when it turns that decision into a retrieval filter. Similarly, pgEdge's shared mutable index could be cleared and repopulated under another request while a tenant-filtered search was in progress. Kong's response-cache issue appears later, when already prepared output may be reused for another consumer. The model need not be deceived in any of these cases: it can summarize unauthorized bytes with perfect fidelity.

The test should therefore follow the record rather than the user session alone. Introduce two principals with deliberately different authorized documents, interleave requests, and record the effective authorization context at selection, index population, model prompt assembly and response delivery. For child identities, perform the analogous experiment across creation and revocation. See the reusable patterns retrieval principal continuity and descendant identity lifecycle.

These reports establish specific authorization or isolation flaws, with distinct levels of vendor and researcher evidence. They do not establish that every customer of the affected products suffered exposure, nor that a single tool-layer allowlist would have blocked all five. A useful audit records the permission subject, the object actually consumed or changed, the point of enforcement and the resulting effect. Anything less may prove that the system checked a permission, without proving it checked the permission that mattered.