Skip to main content

Documentation Index

Fetch the complete documentation index at: https://aarm.dev/llms.txt

Use this file to discover all available pages before exploring further.

​
Overview

AI agents often run with credentials that are broader, longer-lived, and more reusable than the task actually requires. This creates privilege amplification: a small reasoning error or successful attack produces consequences far beyond the user’s original intent.
Over-privileged credentials turn ordinary agent mistakes into security incidents. The issue is not only who the agent is, but how much authority that identity carries by default.

​
How It Happens

Common failure modes:
  • long-lived service tokens reused across many workflows
  • admin-level API keys embedded in agent runtimes
  • broad OAuth scopes granted “for convenience”
  • shared credentials reused across users, tasks, or tenants
Example: 
User asks: "update the due date on one support ticket"
Agent runs with: full project-admin token
Attack impact: agent can close all tickets, export data, or modify team settings

​
Why It Matters

RiskEffect
Excessive scopeOne tool call can affect far more resources than intended
Poor attributionShared credentials blur who authorized what
Long lifetimeCompromise remains useful long after the original task
Cross-context reuseAuthority leaks across unrelated sessions or tenants

​
AARM Mitigations

​
Scoped identities

Bind action execution to:
  • human principal
  • service identity
  • session
  • task scope

​
Just-in-time credentials

Mint narrow, short-lived credentials for the specific action or workflow.

​
Policy checks on effective privilege

Treat privilege scope as part of evaluation context, not just background configuration. 
rules:
  - id: block-admin-token-for-routine-email
    match:
      tool: email.send
      identity.effective_scope: { contains: ["admin"] }
    action: STEP_UP
    reason: "Routine messaging should not use administrator-grade credentials"

​
Detection Signals

SignalIndicates
Scope exceeds task intentThe action is running with more authority than required
Credential reused across unrelated sessionsPoor isolation
High-impact operation under routine workflowPrivilege-task mismatch
Missing user-to-service bindingWeak attribution chain

​
Key Takeaway

Least privilege is not optional in agent systems. AARM treats the effective authority behind an action as part of the runtime decision, not merely as deployment background.

​
Next

Confused Deputy

How manipulated agents misuse legitimate credentials

Action Mediation

Where scoped credentials and invocation policy meet