「grant」の検索結果

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.

日本語の概要は準備中です。原文の説明を表示しています。

Secure the path from an inbound event (webhook, email, SMS, GitHub comment, file, cron) to an agent spawn in the Port Daddy fleet. Use when wiring trigger sources to agents, reviewing the io-wiring registry, adding a trust/permission gate, hardening output sinks (SSRF/path traversal), scoping tools by provenance, or proving the spawn path is safe against prompt-injection → tool-abuse. Encodes ADR-0093 and the red-team threat model. NOT for generic Coast Guard sandboxing (ADR-0050), the macaroon push-grant gate alone (ADR-0053), or non-fleet code.

日本語の概要は準備中です。原文の説明を表示しています。

Validates versioned permission requests against a grant scope and records comparison evidence. Activate on 'validate permissions', 'permission check', 'inheritance validation', 'permission matrix', 'security validation'. NOT for runtime enforcement (use dag-scope-enforcer) or isolation management (use dag-isolation-manager).

日本語の概要は準備中です。原文の説明を表示しています。

Design and validate versioned DAGs with typed dependencies, gates, and evidence-bound readiness. NOT for executing a DAG, granting work authority, or treating an unverified gate as cleared.

日本語の概要は準備中です。原文の説明を表示しています。

Validates typed DAG dependency declarations, returns Kahn linear extensions or generations and residual cycle witnesses, and identifies changed consumers for revalidation. NOT for constructing graphs, scheduling resource capacity, granting effects, or executing nodes.

日本語の概要は準備中です。原文の説明を表示しています。

Design discovery, directories, and guilds for agent swarms at scale. Use when agents need to find each other on a shared surface: capability indices, yellow-pages directories, whois/phonebook routing, reputation-aware discovery, and guild structures that scope trust. Covers the canonical prior art (FIPA Directory Facilitator, Contract Net, Chord/DHT, DNS-SD/Consul, EigenTrust, Greif's merchant guilds) and the failure modes (read-poverty, Sybil reset, Goodhart on rank, directory staleness, cold-start). Triggers: "agents can't find each other", "who owns this file/skill", "route a question to the right agent", "capability registry", "agent reputation", "guild / federation of fleets". NOT for issuing identities, granting authority, or automatically assigning work from a directory entry.

日本語の概要は準備中です。原文の説明を表示しています。

Designs and audits closed, ordered, replay-safe message protocols between already admitted agent bodies. Use when a multi-agent exchange needs explicit epochs, audiences, per-sender sequencing, gathers, terminal fences, acknowledgements, and deterministic replay. NOT for selecting or spawning agents, granting identity or authority, choosing a runtime topology, general human facilitation, wire transport implementation, or deciding whether evidence is true.

日本語の概要は準備中です。原文の説明を表示しています。

Designs and audits deterministic, authority-filtered partitions of trust-typed context for already admitted bodies or abstract continuation slots. Use when causal context, obligations, disclosure boundaries, vector-space identity, capacity, and omission proofs must survive partitioning. NOT for spawning or admitting agents, choosing worker count, retrieving arbitrary knowledge, writing successor prompts, or granting tools, leases, identity, or effect authority.

日本語の概要は準備中です。原文の説明を表示しています。

Build stateful Agents on Cloudflare Workers with current, source-verified SDK APIs. Covers durable state, RPC, chat, schedules, queues, fibers, Workflows, MCP, and channels while keeping authorization and external effects application-owned. NOT for assuming SDK helpers grant application authorization or effect approval.

日本語の概要は準備中です。原文の説明を表示しています。