Layer 02
Safe alone. Dangerous together.
Reading customer records may be allowed. Sending email outside the company may be allowed. Together they form a path for data to leave. Checking each permission on its own never sees that path.
The Problem
Every step passes a one-at-a-time check.
In a cross-tool data theft, each call uses a permission the agent really holds.
01
Per-permission checks say yes every time
A check that asks only “was this granted?” approves each step of the attack, because each step was granted.
02
The danger is in the sum
Read sensitive data, then write somewhere external. Neither step is dangerous alone. The combination is the attack.
03
Access reviews look at one grant at a time
Most access-management systems evaluate roles and scopes individually, so the combination goes unflagged.
The Method
Effects add up. Limits hold.
Each capability is described by what it does, where it reaches and how sensitive its data is.
01
Every capability gets an effect
What it does (read, write, execute), where it reaches (local, internal, external) and how sensitive its data is (public to secret), derived from trace data with no manual labelling.
02
Reach is the combination
The reach of a set of capabilities combines their effects. Adding a capability can only widen reach, never narrow it, so the order of calls cannot be used to slip past the check.
03
Two combinations are blocked
Sensitive data plus an external write, which is data leaving, and code execution plus external reach, which is remote code. A call that would complete either is denied.
Example decision
agent: support-bot task: ticket_triage ✓ crm.customers.read read · internal · sensitive ✓ mail.send.external write · external · internal combined reach write · external · sensitive ✗ DENIED sensitive data would leave the company
Questions
Composition, explained.
Two or more permissions that are harmless alone but together let an agent do something harmful, such as reading customer data and sending it outside the company.
No. Data-loss prevention inspects content as it moves. Composition analysis stops the agent from holding the path in the first place. They work well together.
From each capability’s name and argument shapes in the traces. That is a heuristic, so the person approving a policy confirms each derived effect.
Find out what your agents
are actually allowed to do.
Early access starts with a two-week shadow-mode pilot. Nothing is blocked. You get the gap between the access each agent holds and the access it uses, and every combination that could move data out.