Skip to content

Synthetic demo · No customer connectors attached · Fixture snapshot 24 Sep 2026, 06:15 UTC

Remediation / Synthetic demo

Reduce code agent tool scope to approved purpose

Destructive source-side privilege reduction is deliberately withheld while dependencies are unknown. The local control is reversible.

Observed at 24 Sep 2026, 06:15 UTCrem-8812scoped local controlrequested by Mei Tanaka

All step receipts, approvals and verification results on this page are fixture examples, not live control evidence. The action opens a review preview only.

2 step has not been confirmed applied. Until every step returns a receipt and verification passes, this finding stays open.

Summary

State
awaiting approval
Finding
fnd-2312
Authority
mesh-policy-editor (staging tenant) — requested, not yet granted
Approved by
Not yet approved
Before
14 MCP tools bound; secret-store read and deployment trigger reachable.
After (intended)
Planned: local deny at the mesh boundary for 9 tools. No source-side revocation, because dependency analysis is incomplete.

Created 24 Sep 2026, 05:25 UTC

Steps

Each step carries its own receipt and a compensating action if it cannot be applied.

Scroll table sideways for more columns →

#ActionScopeStatusReceiptCompensation
1Apply local deny for secret-store readagent uc-code-agentPassrcpt-b110 — 2026-09-24 05:22 UTCRemove deny rule
2Apply local deny for 8 remaining out-of-purpose toolsagent uc-code-agentUnknownno receipt returnednone required
3Source-side scope reduction at the MCP server6 staging servicesNot applicableno receipt returnednone required

Verification

Fixed is claimed only when these checks pass against fresh evidence.

Scroll table sideways for more columns →

CheckResultDetail
Forbidden path: secret-store tool call deniedPass4 calls denied since 05:22 UTC with boundary receipts.
Legitimate path: pull-request creation still succeedsPass2 control runs succeeded.
Remaining 8 tools blockedUnknownAwaiting approval before applying.

Evidence

  • Boundary deny receipts

    ev-rem-8812 · receipt · producer mesh-boundary-us · collected 24 Sep 2026, 05:40 UTC (35 min ago)

    SignedValid to 24 Dec 2026, 00:00 UTC