Permission Escalation Detector

Watches for pull requests that change any privilege definition (infrastructure IAM, Kubernetes Role/ClusterRole/RoleBinding, role/permission enums in application code, and workspace membership logic), and classifies each change as widening, narrowing, or neutral. Any widening change raises an approval request for the workspace owner with the diff and a plain-language description of exactly who can now do what they could not before. Narrowing and neutral changes pass through with a comment recording the classification.

Identifier

permission-escalation-detector

Version

1.0.0

Steps

7

Triggers

1

• security
• permissions
• iam
• approval
• governance
• pull-request

When it runs

The pipeline

The graph below is the one the workflow opens with in the builder, same steps, same layout, drawn on the same canvas. The run playing through it is a simulation; the branches and conditions are real.

1. 01
   PR Openedtrigger

   The event that starts the run.

2. 02
   Clone Repositorygit.clone

   Shallow-clones the repository at the right ref.

3. 03
   Detect Permission Escalationsagent.run

   One agent works the task with its toolkit.

4. 04
   Owner Approval for Widened Permissionsapproval.gate

   Pauses the run until a human decides.

5. 05
   Publish Approved Decision Recordreport.publish

   Posts or updates a deduplicated report comment.

6. 06
   Record Rejectionagent.run

   One agent works the task with its toolkit.

7. 07
   Publish Rejection Noticereport.publish

   Posts or updates a deduplicated report comment.

The agent

Permission Escalation Detector

Base type

Code Reviewer

Temperature

0.2

Max iterations

30

Tools

4