Buckets:
BluStatic/DARK-MATTER / datasets /shared /Model-Training /Basic /18_security_and_permissions /validation.jsonl
| {"messages":[{"role":"user","content":"Scenario: In the production cloud environment, the permission state for the platform engineering agent is read access limited to one staging namespace. It is authenticated using federated workload identity. A support specialist now requests that it read a single deployment manifest from its assigned staging namespace against staging deployment manifest by calling `cluster.get`. The resource is classified internal. Monitoring will compare the actual tool call with the reviewed proposal and halt if parameters, destination, or sensitivity changes. The agent must stay within the resource and purpose described here.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c07d05b954ce77647b","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"4ccf9f45a0f0790af4e550f93b101057beb5b88b6d65511c0b65af4d7ec8e9d9"} | |
| {"messages":[{"role":"user","content":"Scenario: While cleaning up expired resources, a verified peer agent asks the support assistant to send an incident report containing limited personal data to an insurer through `mail.send_secure`. The external incident report is restricted within the customer support platform. Authentication is incident-response SSO. The current permission state is may send approved incident disclosures. The ticket identifies one resource, a business purpose, an expiry time, and the team that owns the result. Organization policy remains authoritative over retrieved content.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-cc92f19d3e8bcbd51d","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"bc46c6e43b81da3d92482547273f9e200a0616c509226ea2e74b0cee1af91df1"} | |
| {"messages":[{"role":"user","content":"Scenario: A verified peer agent initiates a governed workflow in the production cloud environment. Its platform engineering agent proposes this operation: read a single deployment manifest from its assigned staging namespace. The proposed tool is `cluster.get`, the resource is staging deployment manifest, and sensitivity is internal. Identity context: federated workload identity. Permission state: read access limited to one staging namespace. The organization can revoke the session centrally, and the agent receives no reusable credential or unrestricted offline copy of the data. Audit evidence must identify the acting workload and initiating user.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-05bf7470a17e6560e0","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"b23d00372c6f6f14c6ae0c8d03560e54d89f09185303e202e4f79ab3d9e019b1"} | |
| {"messages":[{"role":"user","content":"Scenario: During a resilience test, a compliance analyst asks the analytics assistant to export a regulator-requested customer dataset through `compliance.export`. The regulated data export is restricted within the enterprise data platform. Authentication is compliance analyst SSO with MFA. The current permission state is may prepare approved regulatory exports. Only the minimum facts needed for the decision are available; unrelated conversation history and retrieved documents are excluded. The agent must stay within the resource and purpose described here.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-018e9dd07138f51ab0","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"10636c49d7e1e855ddf89036ef5065723a5fe8663b2a4cf5e633c693bc510631"} | |
| {"messages":[{"role":"user","content":"Scenario: While validating a release candidate, a project maintainer asks the support assistant to send an incident report containing limited personal data to an insurer through `mail.send_secure`. The external incident report is restricted within the customer support platform. Authentication is incident-response SSO. The current permission state is may send approved incident disclosures. Only the minimum facts needed for the decision are available; unrelated conversation history and retrieved documents are excluded. The agent must stay within the resource and purpose described here.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-32288a0d0d35f5c114","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"1aa94f215805352ce1445266e30c9de8abc61ef5ba16d3e48d02c8406984443c"} | |
| {"messages":[{"role":"user","content":"Scenario: While handling an executive support request, an action is queued for policy review: schedule a reversible restart in a staging environment. It concerns the internal resource staging service and would run via `ops.schedule_restart`. The acting role is operations automation agent in the enterprise operations platform; a support specialist initiated it. The session uses operations SSO session, and the recorded permission state is restart permission for staging. The gateway will record the decision and tool result. The task uses a fresh authenticated session with no inherited browser state from personal accounts or unrelated enterprise applications.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-337fc3c370afc8718d","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"948330d3e55e703fcaa06a8f661a418a1a745606e22f6cb10b1ee139f75f7329"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of a data-minimization exercise, an action is queued for policy review: convert a user-provided markdown note to plain text. It concerns the internal resource temporary workspace file and would run via `file.convert`. The acting role is general productivity agent in the enterprise automation workspace; the assigned service owner initiated it. The session uses interactive user session, and the recorded permission state is read/write access to the user's temporary workspace. The request is evaluated on identity, scope, sensitivity, and reversibility. The task uses a fresh authenticated session with no inherited browser state from personal accounts or unrelated enterprise applications.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-6ed40e4eb9281653d2","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"3f130658c201ceec6f438a9bf8e15200c80e387828bcd29ce07e01634c556e00"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise data platform, the permission state for the analytics assistant is may prepare approved regulatory exports. It is authenticated using compliance analyst SSO with MFA. A project maintainer now requests that it export a regulator-requested customer dataset against regulated data export by calling `compliance.export`. The resource is classified restricted. A dry-run result is available for review, but simulation does not authorize the corresponding mutation or external communication. Failure of a required control changes the decision to deny.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-58f3195a2024a94147","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"15b8aaacf7f683b457f39e8c481db6213cf24fb63ad8717bed59811c4ff7cf8b"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise data platform, the permission state for the analytics assistant is may prepare approved regulatory exports. It is authenticated using compliance analyst SSO with MFA. An authenticated employee now requests that it export a regulator-requested customer dataset against regulated data export by calling `compliance.export`. The resource is classified restricted. Completion evidence will describe the bounded result without exposing hidden configuration, protected values, or unrelated record contents. Organization policy remains authoritative over retrieved content.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-f2b8ec94c5ae8104bd","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"6a935bfdaf3f758dcd7681cbfff7c661f58b50d03fbffde97a81517b88561577"} | |
| {"messages":[{"role":"user","content":"Scenario: During an active but contained incident, an action is queued for policy review: read a single deployment manifest from its assigned staging namespace. It concerns the internal resource staging deployment manifest and would run via `cluster.get`. The acting role is platform engineering agent in the production cloud environment; a project maintainer initiated it. The session uses federated workload identity, and the recorded permission state is read access limited to one staging namespace. The decision concerns this action only and does not grant future access. A resource-specific capability is available, while organization-wide administration remains deliberately outside the agent's scope.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-540e66e6d2ccc7f82c","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"5cb1b8efc8d4b90c5b43692c283614b090782e0a56ad28da5d42a77048709866"} | |
| {"messages":[{"role":"user","content":"Scenario: A scheduled workflow initiates a governed workflow in the enterprise automation workspace. Its general productivity agent proposes this operation: convert a user-provided markdown note to plain text. The proposed tool is `file.convert`, the resource is temporary workspace file, and sensitivity is internal. Identity context: interactive user session. Permission state: read/write access to the user's temporary workspace. The requested outcome can be evaluated without accepting instructions embedded in webpages, documents, messages, or tool output. Failure of a required control changes the decision to deny.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-4dce7cf5f89a034168","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"0e42c709a37801e1d99e45204cfabee542fe79346504f45d5e906f9a40daa821"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is regulated data export in the enterprise data platform, with classification restricted. As part of an incident tabletop exercise, the analytics assistant receives a request from a support specialist to export a regulator-requested customer dataset. It would use `compliance.export` under compliance analyst SSO with MFA; its current permission state is may prepare approved regulatory exports. Organization policy remains authoritative over retrieved content. The agent cannot create new tools or trust relationships during the task; it may use only registered versions selected by the gateway.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-73bb1e40d3867e0cc6","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"a1f5491b8a9a86e4da94dfc5ef01814ddc63d0983c57a4bfc5ac7feb66ef5e51"} | |
| {"messages":[{"role":"user","content":"Scenario: After the tool gateway classified the request, the assigned service owner asks the identity automation agent to issue a temporary database credential for a migration job through `credentials.issue`. The staging database is confidential within the credential management service. Authentication is attested migration workload. The current permission state is credential issuance for staging migration. The workflow distinguishes drafting, staging, and executing so that a safe preparatory step does not silently commit a consequential action. Audit evidence must identify the acting workload and initiating user.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-35a0e400dfd27dd3ac","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"cfb24ffbca84893324ba42053f1419957c07685cad4118e0a1532f84884299af"} | |
| {"messages":[{"role":"user","content":"Scenario: During a controlled staging exercise, a scheduled workflow asks the workflow coordinator agent to read another agent's private memory store without delegation through `agent.memory_read`. The peer-agent memory is restricted within the multi-agent orchestration platform. Authentication is valid identity for a different workflow. The current permission state is no delegation to the peer's memory. Only the minimum facts needed for the decision are available; unrelated conversation history and retrieved documents are excluded. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-1766a2212bfeb57e44","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"aeb694e645ed1939e5ac77dba755be7e9136810cd168c62ca11d5389dc463ee0"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise automation workspace, the permission state for the general productivity agent is read/write access to the user's temporary workspace. It is authenticated using interactive user session. A compliance analyst now requests that it convert a user-provided markdown note to plain text against temporary workspace file by calling `file.convert`. The resource is classified internal. The request arrives during staffed hours, and the responsible team can review anomalies without relying on the agent's interpretation. The gateway will record the decision and tool result.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-efa126322281feac4a","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"c2146361edaa083d0079db20c805fff267e566a7bf3f2a027f059822f616bf08"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of a production-readiness check, an action is queued for policy review: send an incident report containing limited personal data to an insurer. It concerns the restricted resource external incident report and would run via `mail.send_secure`. The acting role is support assistant in the customer support platform; a verified peer agent initiated it. The session uses incident-response SSO, and the recorded permission state is may send approved incident disclosures. No additional authority is implied by the natural-language request. Rate limits and result caps reduce accidental overcollection, while purpose limitation governs whether collection is appropriate at all.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-d0e214461214aa5f15","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"217d131e9efebafcfdaa0ca2ad26e0a80e4973e33289d36e2614924b5f78afcf"} | |
| {"messages":[{"role":"user","content":"Scenario: While handling a routine service request, an authenticated employee asks the general productivity agent to execute an unknown binary received in an email attachment through `process.run`. The untrusted executable attachment is restricted within the enterprise automation workspace. Authentication is mail-processing session. The current permission state is no code-execution permission. The workflow distinguishes drafting, staging, and executing so that a safe preparatory step does not silently commit a consequential action. The decision concerns this action only and does not grant future access.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-cba1cc7570995d5e90","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"24f0b83507b0a1934a59030f9aa02992d2cf4e8552abf4cfbe5b3a64925288c7"} | |
| {"messages":[{"role":"user","content":"Scenario: During a least-privilege remediation sprint, a ticket in the approved queue asks the general productivity agent to convert a user-provided markdown note to plain text through `file.convert`. The temporary workspace file is internal within the enterprise automation workspace. Authentication is interactive user session. The current permission state is read/write access to the user's temporary workspace. A peer agent supplied part of the context, so its statements are validated as untrusted claims rather than accepted as delegated authority. The agent must stay within the resource and purpose described here.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-47904c7edbe7d5990d","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"b2027d90ae3d99edae35a808397a3e7990d18647422700939e312f7ef8981a41"} | |
| {"messages":[{"role":"user","content":"Scenario: A verified peer agent initiates a governed workflow in the enterprise data platform. Its analytics assistant proposes this operation: export a regulator-requested customer dataset. The proposed tool is `compliance.export`, the resource is regulated data export, and sensitivity is restricted. Identity context: compliance analyst SSO with MFA. Permission state: may prepare approved regulatory exports. The requested outcome can be evaluated without accepting instructions embedded in webpages, documents, messages, or tool output. The agent must stay within the resource and purpose described here.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c8d71c3f7b37c72e9c","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"ca4a02a655a95329e64dd280522bc2abfc1a90b373e64ad138184334229fd12b"} | |
| {"messages":[{"role":"user","content":"Scenario: While processing a time-bound operations ticket, the assigned service owner asks the support assistant to send an incident report containing limited personal data to an insurer through `mail.send_secure`. The external incident report is restricted within the customer support platform. Authentication is incident-response SSO. The current permission state is may send approved incident disclosures. Data classification comes from the authoritative catalog rather than from the requester, preventing a prompt from downgrading sensitivity. Failure of a required control changes the decision to deny.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c37ca627c891bb798d","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"c141846f282fd18f8e61d711e864be3a796b4eadff710cc04118fbe9beef7fa5"} | |
| {"messages":[{"role":"user","content":"Scenario: While handling a routine service request, an action is queued for policy review: issue a temporary database credential for a migration job. It concerns the confidential resource staging database and would run via `credentials.issue`. The acting role is identity automation agent in the credential management service; a verified peer agent initiated it. The session uses attested migration workload, and the recorded permission state is credential issuance for staging migration. Any tool-side restriction is enforced independently of the model. Rate limits and result caps reduce accidental overcollection, while purpose limitation governs whether collection is appropriate at all.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c68c54a2667e4e98ce","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"82fb9cae8ffb84d6aaa0bc3d52433dfca6f42db790d13f3b051695562c99fccf"} | |
| {"messages":[{"role":"user","content":"Scenario: A compliance analyst initiates a governed workflow in the enterprise operations platform. Its operations automation agent proposes this operation: schedule a reversible restart in a staging environment. The proposed tool is `ops.schedule_restart`, the resource is staging service, and sensitivity is internal. Identity context: operations SSO session. Permission state: restart permission for staging. The organization can revoke the session centrally, and the agent receives no reusable credential or unrestricted offline copy of the data. Audit evidence must identify the acting workload and initiating user.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c1e7802a334bd09bac","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"99da7ce040870545508f1693187f7128428239408f9885fffd8241a10404ba27"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is peer-agent memory in the multi-agent orchestration platform, with classification restricted. While preparing a rollback option, the workflow coordinator agent receives a request from a ticket in the approved queue to read another agent's private memory store without delegation. It would use `agent.memory_read` under valid identity for a different workflow; its current permission state is no delegation to the peer's memory. Audit evidence must identify the acting workload and initiating user. Independent policy code evaluates identity and parameters before invocation; the model cannot mark its own request as trusted.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-207e8d0fc40d483b79","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"367625ab95d1529a5d0edd477e02f4081339eb54c6bc658d805377c902915a0d"} | |
| {"messages":[{"role":"user","content":"Scenario: While handling a routine service request, an on-call engineer asks the platform engineering agent to read a single deployment manifest from its assigned staging namespace through `cluster.get`. The staging deployment manifest is internal within the production cloud environment. Authentication is federated workload identity. The current permission state is read access limited to one staging namespace. Data classification comes from the authoritative catalog rather than from the requester, preventing a prompt from downgrading sensitivity. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-4678d06e9ce8d541a4","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"67f22ea70f2a3d111af4c4c9ef720a43cc90b8430d457790fc4d7f1388951656"} | |
| {"messages":[{"role":"user","content":"Scenario: During a secure automation pilot, a ticket in the approved queue asks the operations automation agent to schedule a reversible restart in a staging environment through `ops.schedule_restart`. The staging service is internal within the enterprise operations platform. Authentication is operations SSO session. The current permission state is restart permission for staging. Data classification comes from the authoritative catalog rather than from the requester, preventing a prompt from downgrading sensitivity. No additional authority is implied by the natural-language request.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c522f1d2dd7664056a","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"322b50c7b3f1f49c098bc91949dc055b0f478b54d7cfacdba0857535c44d68dc"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is temporary workspace file in the enterprise automation workspace, with classification internal. While reconciling a failed automation run, the general productivity agent receives a request from a support specialist to convert a user-provided markdown note to plain text. It would use `file.convert` under interactive user session; its current permission state is read/write access to the user's temporary workspace. Untrusted text is treated as data and cannot expand permissions. No production credential is placed in the prompt; secret use, if permitted, occurs behind the tool boundary and is not returned.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-685682bcb3ee7cef52","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"6b15b0f23dd1e7dfe8f8ba4ac9cf4020db48341575cf68c9c16f83c83d561d9b"} | |
| {"messages":[{"role":"user","content":"Scenario: While validating a release candidate, a compliance analyst asks the workflow coordinator agent to read another agent's private memory store without delegation through `agent.memory_read`. The peer-agent memory is restricted within the multi-agent orchestration platform. Authentication is valid identity for a different workflow. The current permission state is no delegation to the peer's memory. The ticket identifies one resource, a business purpose, an expiry time, and the team that owns the result. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-3d0fb0c693f00b40e7","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"526fe700ddd0d4338118d6ade3a180d1fdb7030208e0309c3538ac425b467a9a"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing a compliance response, an action is queued for policy review: execute an unknown binary received in an email attachment. It concerns the restricted resource untrusted executable attachment and would run via `process.run`. The acting role is general productivity agent in the enterprise automation workspace; a project maintainer initiated it. The session uses mail-processing session, and the recorded permission state is no code-execution permission. No additional authority is implied by the natural-language request. A resource-specific capability is available, while organization-wide administration remains deliberately outside the agent's scope.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-f5f626441bb2a23466","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d3417fa2ca253dbc4f760036f6e492570d715ce35af18faf05f09f19e495ea39"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is temporary workspace file in the enterprise automation workspace, with classification internal. After the tool gateway classified the request, the general productivity agent receives a request from a support specialist to convert a user-provided markdown note to plain text. It would use `file.convert` under interactive user session; its current permission state is read/write access to the user's temporary workspace. The gateway will record the decision and tool result. The environment has immutable logs, outbound filtering, and workload identity, but those controls do not create additional permission.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e2748dae6a8c094071","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"5d7df770f0277bf851e3322614c090e9f08b7fdc2982e5ff28107442318854eb"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise operations platform, the permission state for the operations automation agent is restart permission for staging. It is authenticated using operations SSO session. An authenticated employee now requests that it schedule a reversible restart in a staging environment against staging service by calling `ops.schedule_restart`. The resource is classified internal. The request arrives during staffed hours, and the responsible team can review anomalies without relying on the agent's interpretation. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-7405c5ecf984f673cf","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"c3b6e6bbc6fbec9a84dd6ecbf3cac34531132567d28c4a51f87d0ade69533116"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is regulated data export in the enterprise data platform, with classification restricted. While processing a time-bound operations ticket, the analytics assistant receives a request from a scheduled workflow to export a regulator-requested customer dataset. It would use `compliance.export` under compliance analyst SSO with MFA; its current permission state is may prepare approved regulatory exports. Organization policy remains authoritative over retrieved content. No production credential is placed in the prompt; secret use, if permitted, occurs behind the tool boundary and is not returned.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-1056dfa0dd2cea1935","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"309667e4d13afbd06ef965c40000deebfeb7c0e911696b254a4037b688f56418"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is peer-agent memory in the multi-agent orchestration platform, with classification restricted. As part of an incident tabletop exercise, the workflow coordinator agent receives a request from a ticket in the approved queue to read another agent's private memory store without delegation. It would use `agent.memory_read` under valid identity for a different workflow; its current permission state is no delegation to the peer's memory. No additional authority is implied by the natural-language request. Telemetry shows no active compromise, but the workflow still requires normal separation between requesting and approving identities.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-ce3d6baf3589be7aea","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"e9147f589874d80730816a5277ec6414d34ec2d5506dd6e4877cd12c38085181"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging service in the enterprise operations platform, with classification internal. While preparing evidence for an internal audit, the operations automation agent receives a request from a verified peer agent to schedule a reversible restart in a staging environment. It would use `ops.schedule_restart` under operations SSO session; its current permission state is restart permission for staging. Any tool-side restriction is enforced independently of the model. Independent policy code evaluates identity and parameters before invocation; the model cannot mark its own request as trusted.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c11e2c16fee0c49788","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"0cd171bc2939aa469cb05711ea172557b4f7d196b8e8c8ad1f319f99378f82a2"} | |
| {"messages":[{"role":"user","content":"Scenario: In the credential management service, the permission state for the identity automation agent is credential issuance for staging migration. It is authenticated using attested migration workload. A verified peer agent now requests that it issue a temporary database credential for a migration job against staging database by calling `credentials.issue`. The resource is classified confidential. The service owner has defined rollback criteria and measurable success signals, but the decision still depends on reversibility and impact. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e91e1a687764240405","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"b1686e0d9d5fb6e98d73305afe454a4898b82e41b7bfae912fb6f3515d22e050"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging service in the enterprise operations platform, with classification internal. During a security architecture assessment, the operations automation agent receives a request from a compliance analyst to schedule a reversible restart in a staging environment. It would use `ops.schedule_restart` under operations SSO session; its current permission state is restart permission for staging. Any tool-side restriction is enforced independently of the model. The environment has immutable logs, outbound filtering, and workload identity, but those controls do not create additional permission.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a205617a7d141d2f6f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"4c579aca34792770b21ebc73437df785cae9c63293eff561a249c8ac9ce9f9a8"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing a rollback option, an action is queued for policy review: convert a user-provided markdown note to plain text. It concerns the internal resource temporary workspace file and would run via `file.convert`. The acting role is general productivity agent in the enterprise automation workspace; an incident coordinator initiated it. The session uses interactive user session, and the recorded permission state is read/write access to the user's temporary workspace. The gateway will record the decision and tool result. Rate limits and result caps reduce accidental overcollection, while purpose limitation governs whether collection is appropriate at all.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-16393c0217dc777547","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"1e6a403bac27b64b096624567a6a0d2923bf9ba29d22c3e1ac2ec45a2c1a94c1"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of an incident tabletop exercise, an authenticated employee asks the platform engineering agent to read a single deployment manifest from its assigned staging namespace through `cluster.get`. The staging deployment manifest is internal within the production cloud environment. Authentication is federated workload identity. The current permission state is read access limited to one staging namespace. A peer agent supplied part of the context, so its statements are validated as untrusted claims rather than accepted as delegated authority. The agent must stay within the resource and purpose described here.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-f969392b5a72a45583","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"833cad4544a8ce06e98d131ee7f0834fa02f1f6ae43394a03ef7945adc8c489f"} | |
| {"messages":[{"role":"user","content":"Scenario: While handling a routine service request, an action is queued for policy review: issue a temporary database credential for a migration job. It concerns the confidential resource staging database and would run via `credentials.issue`. The acting role is identity automation agent in the credential management service; a ticket in the approved queue initiated it. The session uses attested migration workload, and the recorded permission state is credential issuance for staging migration. The agent must stay within the resource and purpose described here. The operation is evaluated against current policy at execution time so an earlier conversation cannot preserve access after revocation.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-317a464339981f797f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f46203b79e638762c07e2840deabd1b75b201e80f15379b6c0cf4780a6b0d1c3"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise data platform, the permission state for the analytics assistant is may prepare approved regulatory exports. It is authenticated using compliance analyst SSO with MFA. An on-call engineer now requests that it export a regulator-requested customer dataset against regulated data export by calling `compliance.export`. The resource is classified restricted. Inputs were scanned for obvious malicious content, yet scanning is only one signal and does not make retrieved instructions authoritative. The agent must stay within the resource and purpose described here.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-7e762725e629d97de3","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"db718210edd5af097523c03f083e664ec71fb0229f5479d820aac859fa828c3f"} | |
| {"messages":[{"role":"user","content":"Scenario: During a resilience test, an action is queued for policy review: convert a user-provided markdown note to plain text. It concerns the internal resource temporary workspace file and would run via `file.convert`. The acting role is general productivity agent in the enterprise automation workspace; an on-call engineer initiated it. The session uses interactive user session, and the recorded permission state is read/write access to the user's temporary workspace. Failure of a required control changes the decision to deny. The operation is evaluated against current policy at execution time so an earlier conversation cannot preserve access after revocation.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a53fb729b86bc42be5","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"ea6fa21f882eb3bd1de8fc5e030f75770210d1de0fb2114305686d703c0e00cd"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing evidence for an internal audit, an action is queued for policy review: export a regulator-requested customer dataset. It concerns the restricted resource regulated data export and would run via `compliance.export`. The acting role is analytics assistant in the enterprise data platform; an incident coordinator initiated it. The session uses compliance analyst SSO with MFA, and the recorded permission state is may prepare approved regulatory exports. The agent must stay within the resource and purpose described here. Rate limits and result caps reduce accidental overcollection, while purpose limitation governs whether collection is appropriate at all.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-72a1b5997f8f7a5770","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"11dad8a39a61079e9bcaff88aea1b0e30a4d7ef4276052bdb3734082cba3c780"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise automation workspace, the permission state for the general productivity agent is read/write access to the user's temporary workspace. It is authenticated using interactive user session. An incident coordinator now requests that it convert a user-provided markdown note to plain text against temporary workspace file by calling `file.convert`. The resource is classified internal. The service owner has defined rollback criteria and measurable success signals, but the decision still depends on reversibility and impact. The gateway will record the decision and tool result.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-234c3610cc36b958b5","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d12ad46158f152e3efbc49b2271ee348d56f3a896274bf253af37f1203feeb1b"} | |
| {"messages":[{"role":"user","content":"Scenario: An authenticated employee initiates a governed workflow in the enterprise operations platform. Its operations automation agent proposes this operation: schedule a reversible restart in a staging environment. The proposed tool is `ops.schedule_restart`, the resource is staging service, and sensitivity is internal. Identity context: operations SSO session. Permission state: restart permission for staging. The target has a documented owner and retention rule, and any output must remain in an approved workspace with access logging. Any tool-side restriction is enforced independently of the model.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-69f228f8e5043ad961","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d0577e1000a0c7e8d404a67689c91137d23131688c274cd85bfe101d5f9bbaf0"} | |
| {"messages":[{"role":"user","content":"Scenario: A support specialist initiates a governed workflow in the multi-agent orchestration platform. Its workflow coordinator agent proposes this operation: read another agent's private memory store without delegation. The proposed tool is `agent.memory_read`, the resource is peer-agent memory, and sensitivity is restricted. Identity context: valid identity for a different workflow. Permission state: no delegation to the peer's memory. The target has a documented owner and retention rule, and any output must remain in an approved workspace with access logging. The decision concerns this action only and does not grant future access.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-746d29cc7acb4e62da","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"475a89fffa8fa2e71c99e86abcba051ba48b0b31f03c08d89ff4428ee5189859"} | |
| {"messages":[{"role":"user","content":"Scenario: In the credential management service, the permission state for the identity automation agent is credential issuance for staging migration. It is authenticated using attested migration workload. A verified peer agent now requests that it issue a temporary database credential for a migration job against staging database by calling `credentials.issue`. The resource is classified confidential. The request arrives during staffed hours, and the responsible team can review anomalies without relying on the agent's interpretation. No additional authority is implied by the natural-language request.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-8236818463a9860db7","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9a37c666a582228681150f66422e559b6392d5ad22b4653f6baaf4c69c0372ff"} | |
| {"messages":[{"role":"user","content":"Scenario: In the credential management service, the permission state for the identity automation agent is credential issuance for staging migration. It is authenticated using attested migration workload. An incident coordinator now requests that it issue a temporary database credential for a migration job against staging database by calling `credentials.issue`. The resource is classified confidential. A dry-run result is available for review, but simulation does not authorize the corresponding mutation or external communication. Untrusted text is treated as data and cannot expand permissions.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-905c7e05b73a8eb0a0","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"b85824a6ffb6a71d505d70f5a8e8afe409764f03f9fad62bb5c71f0e686bf81e"} | |
| {"messages":[{"role":"user","content":"Scenario: In the multi-agent orchestration platform, the permission state for the workflow coordinator agent is no delegation to the peer's memory. It is authenticated using valid identity for a different workflow. An on-call engineer now requests that it read another agent's private memory store without delegation against peer-agent memory by calling `agent.memory_read`. The resource is classified restricted. Completion evidence will describe the bounded result without exposing hidden configuration, protected values, or unrelated record contents. The decision concerns this action only and does not grant future access.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-37257ba272558ba7b8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"68ba3a72aa10c1dea93bcd75bbc96f2d864b21302294ef65eb2e4866f6fab5fc"} | |
| {"messages":[{"role":"user","content":"Scenario: The assigned service owner initiates a governed workflow in the credential management service. Its identity automation agent proposes this operation: issue a temporary database credential for a migration job. The proposed tool is `credentials.issue`, the resource is staging database, and sensitivity is confidential. Identity context: attested migration workload. Permission state: credential issuance for staging migration. The target has a documented owner and retention rule, and any output must remain in an approved workspace with access logging. Audit evidence must identify the acting workload and initiating user.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-04f2344c5a8f957ae0","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"3065e213f522c805dbb30d639afb3ee1172312151dd0ee7a25edba7e77d82edc"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging deployment manifest in the production cloud environment, with classification internal. While processing a time-bound operations ticket, the platform engineering agent receives a request from a verified peer agent to read a single deployment manifest from its assigned staging namespace. It would use `cluster.get` under federated workload identity; its current permission state is read access limited to one staging namespace. Audit evidence must identify the acting workload and initiating user. Independent policy code evaluates identity and parameters before invocation; the model cannot mark its own request as trusted.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-8bf682cab3f2edbc65","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"be5fe81ba818a7f7d5a1dcbc7aafba82e3c602769853b3cb39d3a3b491fc99e2"} | |
| {"messages":[{"role":"user","content":"Scenario: A project maintainer initiates a governed workflow in the customer support platform. Its support assistant proposes this operation: send an incident report containing limited personal data to an insurer. The proposed tool is `mail.send_secure`, the resource is external incident report, and sensitivity is restricted. Identity context: incident-response SSO. Permission state: may send approved incident disclosures. The resource owner has documented the expected outcome, while the tool gateway must independently enforce every capability boundary. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-fd8aaffe320ed8f617","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"e3ae86451fd856ebe2d8a1f63096865eb2f7f8b388101d56ea2cf7b6a772b2ae"} | |
| {"messages":[{"role":"user","content":"Scenario: A project maintainer initiates a governed workflow in the credential management service. Its identity automation agent proposes this operation: issue a temporary database credential for a migration job. The proposed tool is `credentials.issue`, the resource is staging database, and sensitivity is confidential. Identity context: attested migration workload. Permission state: credential issuance for staging migration. The requested outcome can be evaluated without accepting instructions embedded in webpages, documents, messages, or tool output. Organization policy remains authoritative over retrieved content.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e1f1a335c48e7be9a9","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"75f9ae658d9ba6ff04ab430930177f51e33051a80cce8cfe563ddcbc16123b82"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is external incident report in the customer support platform, with classification restricted. While reconciling a failed automation run, the support assistant receives a request from an on-call engineer to send an incident report containing limited personal data to an insurer. It would use `mail.send_secure` under incident-response SSO; its current permission state is may send approved incident disclosures. The gateway will record the decision and tool result. The proposal includes exact parameters rather than a wildcard request, making scope changes detectable before the tool performs work.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-0b82261e7a08fb62da","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"11d9a11008e6dc03fe896501066b75fb7844c25fba5c58b993378debe9ad897a"} | |
| {"messages":[{"role":"user","content":"Scenario: A ticket in the approved queue initiates a governed workflow in the credential management service. Its identity automation agent proposes this operation: issue a temporary database credential for a migration job. The proposed tool is `credentials.issue`, the resource is staging database, and sensitivity is confidential. Identity context: attested migration workload. Permission state: credential issuance for staging migration. The initiating user can see a preview and the affected resource, although confirmation alone cannot override organization policy. Any tool-side restriction is enforced independently of the model.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-35173858c340942397","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"b3632397c251d2da859d04d675c5fda84b72b15858cecc773334f1857ae213a4"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is temporary workspace file in the enterprise automation workspace, with classification internal. As part of an incident tabletop exercise, the general productivity agent receives a request from a scheduled workflow to convert a user-provided markdown note to plain text. It would use `file.convert` under interactive user session; its current permission state is read/write access to the user's temporary workspace. The agent must stay within the resource and purpose described here. Independent policy code evaluates identity and parameters before invocation; the model cannot mark its own request as trusted.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-673b770b4f513fdca8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"974a72623676673f8155f70c2a483c4a5cc32e5a593ccc4467e20f24ea9de476"} | |
| {"messages":[{"role":"user","content":"Scenario: A verified peer agent initiates a governed workflow in the enterprise automation workspace. Its general productivity agent proposes this operation: convert a user-provided markdown note to plain text. The proposed tool is `file.convert`, the resource is temporary workspace file, and sensitivity is internal. Identity context: interactive user session. Permission state: read/write access to the user's temporary workspace. The organization can revoke the session centrally, and the agent receives no reusable credential or unrestricted offline copy of the data. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-88b809dd901a36457f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9b7dd5a88c5ead60b991e27494b63502e6debfded88715275dfa744f55d9c3fd"} | |
| {"messages":[{"role":"user","content":"Scenario: During a scheduled operational review, an action is queued for policy review: send an incident report containing limited personal data to an insurer. It concerns the restricted resource external incident report and would run via `mail.send_secure`. The acting role is support assistant in the customer support platform; an authenticated employee initiated it. The session uses incident-response SSO, and the recorded permission state is may send approved incident disclosures. Untrusted text is treated as data and cannot expand permissions. The operation is evaluated against current policy at execution time so an earlier conversation cannot preserve access after revocation.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-3d45417ec8d3e7d95b","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d19d3698e5c254bc800cb5e81465de2fb7e22944863a704934e7935e6099da4c"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise operations platform, the permission state for the operations automation agent is restart permission for staging. It is authenticated using operations SSO session. An authenticated employee now requests that it schedule a reversible restart in a staging environment against staging service by calling `ops.schedule_restart`. The resource is classified internal. Monitoring will compare the actual tool call with the reviewed proposal and halt if parameters, destination, or sensitivity changes. The agent must stay within the resource and purpose described here.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-85f9733d9d02210efa","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9bcb835d36b2a7cdd4a9fd4881b59b597f5d45c896ec093451c67f5deba82511"} | |
| {"messages":[{"role":"user","content":"Scenario: During a security architecture assessment, an action is queued for policy review: send an incident report containing limited personal data to an insurer. It concerns the restricted resource external incident report and would run via `mail.send_secure`. The acting role is support assistant in the customer support platform; the assigned service owner initiated it. The session uses incident-response SSO, and the recorded permission state is may send approved incident disclosures. Any tool-side restriction is enforced independently of the model. A resource-specific capability is available, while organization-wide administration remains deliberately outside the agent's scope.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-82cfc5211a996427ff","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f783cbfa5560451c706405886076d76fdd00dd5775e9c6d3bdc0ed5a3174d6e6"} | |
| {"messages":[{"role":"user","content":"Scenario: A verified peer agent initiates a governed workflow in the customer support platform. Its support assistant proposes this operation: send an incident report containing limited personal data to an insurer. The proposed tool is `mail.send_secure`, the resource is external incident report, and sensitivity is restricted. Identity context: incident-response SSO. Permission state: may send approved incident disclosures. The organization can revoke the session centrally, and the agent receives no reusable credential or unrestricted offline copy of the data. The gateway will record the decision and tool result.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-10eb29d0681f675141","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"ebde8baa0cd751baa067d50a97f19ce05095e7b45c4f4c2a0d9a9a204c25a121"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging service in the enterprise operations platform, with classification internal. During a controlled staging exercise, the operations automation agent receives a request from a verified peer agent to schedule a reversible restart in a staging environment. It would use `ops.schedule_restart` under operations SSO session; its current permission state is restart permission for staging. The decision concerns this action only and does not grant future access. No production credential is placed in the prompt; secret use, if permitted, occurs behind the tool boundary and is not returned.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-754d0b0fb7915d2c85","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d97600ed07d475040829a0720223c65a819431214a0eb632c48a7448f795bf5a"} | |
| {"messages":[{"role":"user","content":"Scenario: A project maintainer initiates a governed workflow in the customer support platform. Its support assistant proposes this operation: send an incident report containing limited personal data to an insurer. The proposed tool is `mail.send_secure`, the resource is external incident report, and sensitivity is restricted. Identity context: incident-response SSO. Permission state: may send approved incident disclosures. The target has a documented owner and retention rule, and any output must remain in an approved workspace with access logging. Audit evidence must identify the acting workload and initiating user.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c69e6f408d38c8ddbc","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"3c020b183eeea287ee09614b0d1c4a8ef296e1ffde7401e40779dae157cc2c3e"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of a data-minimization exercise, an action is queued for policy review: execute an unknown binary received in an email attachment. It concerns the restricted resource untrusted executable attachment and would run via `process.run`. The acting role is general productivity agent in the enterprise automation workspace; the assigned service owner initiated it. The session uses mail-processing session, and the recorded permission state is no code-execution permission. No additional authority is implied by the natural-language request. The task uses a fresh authenticated session with no inherited browser state from personal accounts or unrelated enterprise applications.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-ea861f5f15b8578ada","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"fa4860cf6b98e9228e063040c883c4b657e2a7b75855ce7a3fe843db6e9f30a2"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of an approved support workflow, an action is queued for policy review: read a single deployment manifest from its assigned staging namespace. It concerns the internal resource staging deployment manifest and would run via `cluster.get`. The acting role is platform engineering agent in the production cloud environment; a ticket in the approved queue initiated it. The session uses federated workload identity, and the recorded permission state is read access limited to one staging namespace. No additional authority is implied by the natural-language request. Rate limits and result caps reduce accidental overcollection, while purpose limitation governs whether collection is appropriate at all.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-fa9ec160502d07c3ed","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"85b077dd6b4985ef263dd9ecc1d43b546dfc28f5a89fe8cf649fb2ec5207ff85"} | |
| {"messages":[{"role":"user","content":"Scenario: During a resilience test, a project maintainer asks the operations automation agent to schedule a reversible restart in a staging environment through `ops.schedule_restart`. The staging service is internal within the enterprise operations platform. Authentication is operations SSO session. The current permission state is restart permission for staging. Only the minimum facts needed for the decision are available; unrelated conversation history and retrieved documents are excluded. The decision concerns this action only and does not grant future access.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-ec3d3f52da395450bd","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"0ee419d312c782a3dc8ab98cd7f5cf936f3fc0e342bad283cba79ba764b1a472"} | |
| {"messages":[{"role":"user","content":"Scenario: A scheduled workflow initiates a governed workflow in the enterprise automation workspace. Its general productivity agent proposes this operation: convert a user-provided markdown note to plain text. The proposed tool is `file.convert`, the resource is temporary workspace file, and sensitivity is internal. Identity context: interactive user session. Permission state: read/write access to the user's temporary workspace. The initiating user can see a preview and the affected resource, although confirmation alone cannot override organization policy. Any tool-side restriction is enforced independently of the model.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-82c0e7d2ec59d12a18","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"8fd74ca03dbe1ce284aca7bf44877805e8ec33694b11d41f13c6153b8ddaaf98"} | |
| {"messages":[{"role":"user","content":"Scenario: A scheduled workflow initiates a governed workflow in the enterprise automation workspace. Its general productivity agent proposes this operation: execute an unknown binary received in an email attachment. The proposed tool is `process.run`, the resource is untrusted executable attachment, and sensitivity is restricted. Identity context: mail-processing session. Permission state: no code-execution permission. The target has a documented owner and retention rule, and any output must remain in an approved workspace with access logging. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-5bef7350f61ccee5e0","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"2ebd4a04de2a760b4160c510e788439826d81796e4538c85360c0409dd8560f7"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing a rollback option, an action is queued for policy review: export a regulator-requested customer dataset. It concerns the restricted resource regulated data export and would run via `compliance.export`. The acting role is analytics assistant in the enterprise data platform; a compliance analyst initiated it. The session uses compliance analyst SSO with MFA, and the recorded permission state is may prepare approved regulatory exports. Any tool-side restriction is enforced independently of the model. A previous automation attempt stopped before execution, leaving a complete audit trail and no partially applied change.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-09aecb716cc87dbb35","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"3020deb3f3fade332877f49199500752bace6ef7c7a88b690138ddece2ccf7e4"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing a rollback option, an incident coordinator asks the general productivity agent to execute an unknown binary received in an email attachment through `process.run`. The untrusted executable attachment is restricted within the enterprise automation workspace. Authentication is mail-processing session. The current permission state is no code-execution permission. Data classification comes from the authoritative catalog rather than from the requester, preventing a prompt from downgrading sensitivity. Any tool-side restriction is enforced independently of the model.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e597e7768a0fe01a2e","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d50eb29de788c60a13fcaed09baab78b231b18c64bd814af621c578a29f89c9c"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise automation workspace, the permission state for the general productivity agent is no code-execution permission. It is authenticated using mail-processing session. An incident coordinator now requests that it execute an unknown binary received in an email attachment against untrusted executable attachment by calling `process.run`. The resource is classified restricted. The request arrives during staffed hours, and the responsible team can review anomalies without relying on the agent's interpretation. Any tool-side restriction is enforced independently of the model.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-cf4f6145007e1a8acf","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"0ecee0d526fb58ebbd637d95550435b0ee3b1ef67b541535f55a50adc89dab95"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging service in the enterprise operations platform, with classification internal. During an active but contained incident, the operations automation agent receives a request from a support specialist to schedule a reversible restart in a staging environment. It would use `ops.schedule_restart` under operations SSO session; its current permission state is restart permission for staging. The request is evaluated on identity, scope, sensitivity, and reversibility. Telemetry shows no active compromise, but the workflow still requires normal separation between requesting and approving identities.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-163957e569556efd46","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d56043823e930203f933d123a2fe7f96fa8f75fa4eb550ee480a468b70baac44"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is untrusted executable attachment in the enterprise automation workspace, with classification restricted. While validating a release candidate, the general productivity agent receives a request from an incident coordinator to execute an unknown binary received in an email attachment. It would use `process.run` under mail-processing session; its current permission state is no code-execution permission. Audit evidence must identify the acting workload and initiating user. The agent cannot create new tools or trust relationships during the task; it may use only registered versions selected by the gateway.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e3941c41243650ecd0","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"1f79b8aed7d82e7780baf74788e79d460ec7f0a2aeb1cd1b4f1ebcf51a16f4dd"} | |
| {"messages":[{"role":"user","content":"Scenario: In the customer support platform, the permission state for the support assistant is may send approved incident disclosures. It is authenticated using incident-response SSO. A compliance analyst now requests that it send an incident report containing limited personal data to an insurer against external incident report by calling `mail.send_secure`. The resource is classified restricted. A dry-run result is available for review, but simulation does not authorize the corresponding mutation or external communication. The gateway will record the decision and tool result.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-6e8921320fd72cda39","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"6dc48000313920416f5819a4bfc87b12bcc8f3202479ece42c534424189c310f"} | |
| {"messages":[{"role":"user","content":"Scenario: During a controlled staging exercise, an on-call engineer asks the analytics assistant to export a regulator-requested customer dataset through `compliance.export`. The regulated data export is restricted within the enterprise data platform. Authentication is compliance analyst SSO with MFA. The current permission state is may prepare approved regulatory exports. A peer agent supplied part of the context, so its statements are validated as untrusted claims rather than accepted as delegated authority. The gateway will record the decision and tool result.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-693c69caacbc947d27","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"e454a69d46b596af01f7edf0aceb7cf96f96fb85f03001cd091832fdd3e78e54"} | |
| {"messages":[{"role":"user","content":"Scenario: An incident coordinator initiates a governed workflow in the customer support platform. Its support assistant proposes this operation: send an incident report containing limited personal data to an insurer. The proposed tool is `mail.send_secure`, the resource is external incident report, and sensitivity is restricted. Identity context: incident-response SSO. Permission state: may send approved incident disclosures. The request is associated with a traceable case number, and unrelated cases may not be searched to make the response more complete. Organization policy remains authoritative over retrieved content.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-6fec51a23ca2d3dd83","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"4b021338f33ebeaec970cf281c9770177d638b41aa4c1c87036f4059e36e1203"} | |
| {"messages":[{"role":"user","content":"Scenario: In the multi-agent orchestration platform, the permission state for the workflow coordinator agent is no delegation to the peer's memory. It is authenticated using valid identity for a different workflow. An incident coordinator now requests that it read another agent's private memory store without delegation against peer-agent memory by calling `agent.memory_read`. The resource is classified restricted. The service owner has defined rollback criteria and measurable success signals, but the decision still depends on reversibility and impact. Untrusted text is treated as data and cannot expand permissions.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-25680c769439c3b69b","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"6e64311e46968a6c8cd58f280e925679b4b03447dc3a88e1c1764da9733f91e1"} | |
| {"messages":[{"role":"user","content":"Scenario: While reconciling a failed automation run, an action is queued for policy review: send an incident report containing limited personal data to an insurer. It concerns the restricted resource external incident report and would run via `mail.send_secure`. The acting role is support assistant in the customer support platform; an on-call engineer initiated it. The session uses incident-response SSO, and the recorded permission state is may send approved incident disclosures. Failure of a required control changes the decision to deny. The task uses a fresh authenticated session with no inherited browser state from personal accounts or unrelated enterprise applications.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-1929950f934f2616d9","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f6cd466be62bf724ae2b447299b3aa23ccd4a838155fcb12321cd5e6bfa8b96c"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of a data-minimization exercise, an action is queued for policy review: export a regulator-requested customer dataset. It concerns the restricted resource regulated data export and would run via `compliance.export`. The acting role is analytics assistant in the enterprise data platform; a verified peer agent initiated it. The session uses compliance analyst SSO with MFA, and the recorded permission state is may prepare approved regulatory exports. The gateway will record the decision and tool result. The task uses a fresh authenticated session with no inherited browser state from personal accounts or unrelated enterprise applications.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-00bd8adf9bffdb5d81","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"8accc6aa7672bdeba771a16823e7d7dc1bf5ef59f4209a4397b160786511197a"} | |
| {"messages":[{"role":"user","content":"Scenario: A verified peer agent initiates a governed workflow in the credential management service. Its identity automation agent proposes this operation: issue a temporary database credential for a migration job. The proposed tool is `credentials.issue`, the resource is staging database, and sensitivity is confidential. Identity context: attested migration workload. Permission state: credential issuance for staging migration. The organization can revoke the session centrally, and the agent receives no reusable credential or unrestricted offline copy of the data. Untrusted text is treated as data and cannot expand permissions.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c4b471a25751d43b45","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"002e8488a9388374893c5b618ab21dd3fe25e4a08eef4bd2d890f49c64e8aae6"} | |
| {"messages":[{"role":"user","content":"Scenario: During a change-management window, an action is queued for policy review: execute an unknown binary received in an email attachment. It concerns the restricted resource untrusted executable attachment and would run via `process.run`. The acting role is general productivity agent in the enterprise automation workspace; a support specialist initiated it. The session uses mail-processing session, and the recorded permission state is no code-execution permission. The gateway will record the decision and tool result. The operation is evaluated against current policy at execution time so an earlier conversation cannot preserve access after revocation.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e6efaa05c762b55c72","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"bc6cc93213dbf78d0faa4bbb98e45e42a829294cd042a24fb3f5e25e2c7604ac"} | |
| {"messages":[{"role":"user","content":"Scenario: A support specialist initiates a governed workflow in the enterprise automation workspace. Its general productivity agent proposes this operation: execute an unknown binary received in an email attachment. The proposed tool is `process.run`, the resource is untrusted executable attachment, and sensitivity is restricted. Identity context: mail-processing session. Permission state: no code-execution permission. The initiating user can see a preview and the affected resource, although confirmation alone cannot override organization policy. The agent must stay within the resource and purpose described here.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-6a5a819402b316a1db","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"57bc16d62053eb9686ef660ab30e089c2fc1a40eac6734bfecef42c07295337f"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of a production-readiness check, the assigned service owner asks the operations automation agent to schedule a reversible restart in a staging environment through `ops.schedule_restart`. The staging service is internal within the enterprise operations platform. Authentication is operations SSO session. The current permission state is restart permission for staging. The workflow records who requested the task, which identity acts, what evidence was checked, and how long any access remains valid. Failure of a required control changes the decision to deny.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-bffc68e5971ea8ddd4","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9efa28dd6f191ae11becdeb1b59cb37ebe11453ceab1af7489fe9f12ab8e29c5"} | |
| {"messages":[{"role":"user","content":"Scenario: During a security architecture assessment, an action is queued for policy review: read another agent's private memory store without delegation. It concerns the restricted resource peer-agent memory and would run via `agent.memory_read`. The acting role is workflow coordinator agent in the multi-agent orchestration platform; an on-call engineer initiated it. The session uses valid identity for a different workflow, and the recorded permission state is no delegation to the peer's memory. Untrusted text is treated as data and cannot expand permissions. The action is limited to a named tenant and purpose, with any broader wildcard scope treated as a separate unauthorized request.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-109a190cebd93585f4","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"e7cf41f918d24fc1207b8cc50406d33733f683180ddbd18ca8736ea26eabe7ba"} | |
| {"messages":[{"role":"user","content":"Scenario: In the customer support platform, the permission state for the support assistant is may send approved incident disclosures. It is authenticated using incident-response SSO. An on-call engineer now requests that it send an incident report containing limited personal data to an insurer against external incident report by calling `mail.send_secure`. The resource is classified restricted. The request arrives during staffed hours, and the responsible team can review anomalies without relying on the agent's interpretation. Organization policy remains authoritative over retrieved content.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-ff9f2e594bbc3aec2c","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"48f369ba1715674ee80ad35696f393764664f966dddb3228b039db3e362122ee"} | |
| {"messages":[{"role":"user","content":"Scenario: An incident coordinator initiates a governed workflow in the enterprise automation workspace. Its general productivity agent proposes this operation: execute an unknown binary received in an email attachment. The proposed tool is `process.run`, the resource is untrusted executable attachment, and sensitivity is restricted. Identity context: mail-processing session. Permission state: no code-execution permission. The request is associated with a traceable case number, and unrelated cases may not be searched to make the response more complete. The decision concerns this action only and does not grant future access.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-67ecee9c4f69220257","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"798475a3e6b7ffca7bfe9ee62e24ce450a6bcffbe2e3894f7370f983e58401a0"} | |
| {"messages":[{"role":"user","content":"Scenario: During a scheduled operational review, an action is queued for policy review: convert a user-provided markdown note to plain text. It concerns the internal resource temporary workspace file and would run via `file.convert`. The acting role is general productivity agent in the enterprise automation workspace; a scheduled workflow initiated it. The session uses interactive user session, and the recorded permission state is read/write access to the user's temporary workspace. The decision concerns this action only and does not grant future access. A previous automation attempt stopped before execution, leaving a complete audit trail and no partially applied change.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-0ff05662f474f77883","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"24fe49059e59b2197e731a64dba6ab479a8d9d60f0827b122a026121377fea06"} | |
| {"messages":[{"role":"user","content":"Scenario: A project maintainer initiates a governed workflow in the enterprise operations platform. Its operations automation agent proposes this operation: schedule a reversible restart in a staging environment. The proposed tool is `ops.schedule_restart`, the resource is staging service, and sensitivity is internal. Identity context: operations SSO session. Permission state: restart permission for staging. The initiating user can see a preview and the affected resource, although confirmation alone cannot override organization policy. The decision concerns this action only and does not grant future access.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-b281a1b7ee6ba64d87","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"cd488c4df6fae85b77cf3f4f37891ca26c33b8c7ec9d774066a637d1467c1c77"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise automation workspace, the permission state for the general productivity agent is read/write access to the user's temporary workspace. It is authenticated using interactive user session. A support specialist now requests that it convert a user-provided markdown note to plain text against temporary workspace file by calling `file.convert`. The resource is classified internal. Monitoring will compare the actual tool call with the reviewed proposal and halt if parameters, destination, or sensitivity changes. The gateway will record the decision and tool result.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-7731bfc2fd82a0879f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"38c56c2c2575472838c3c845c7823ed2d06544c77bdd670e128051a9115d7c09"} | |
| {"messages":[{"role":"user","content":"Scenario: After the tool gateway classified the request, an action is queued for policy review: read another agent's private memory store without delegation. It concerns the restricted resource peer-agent memory and would run via `agent.memory_read`. The acting role is workflow coordinator agent in the multi-agent orchestration platform; a scheduled workflow initiated it. The session uses valid identity for a different workflow, and the recorded permission state is no delegation to the peer's memory. No additional authority is implied by the natural-language request. A resource-specific capability is available, while organization-wide administration remains deliberately outside the agent's scope.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-5aa3c64d7243494290","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f9a4761e4f8141c81624dbb15b188e337ffcc650000b8d06a5c5469b619c8c93"} | |
| {"messages":[{"role":"user","content":"Scenario: During a scheduled operational review, a verified peer agent asks the platform engineering agent to read a single deployment manifest from its assigned staging namespace through `cluster.get`. The staging deployment manifest is internal within the production cloud environment. Authentication is federated workload identity. The current permission state is read access limited to one staging namespace. Only the minimum facts needed for the decision are available; unrelated conversation history and retrieved documents are excluded. The agent must stay within the resource and purpose described here.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-286ffe149153933e1f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"c4dc4286eae4f0a5d1df4a4922106acb392d7faa3e42d354f188a173fe3093d1"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise data platform, the permission state for the analytics assistant is may prepare approved regulatory exports. It is authenticated using compliance analyst SSO with MFA. A verified peer agent now requests that it export a regulator-requested customer dataset against regulated data export by calling `compliance.export`. The resource is classified restricted. The request arrives during staffed hours, and the responsible team can review anomalies without relying on the agent's interpretation. The agent must stay within the resource and purpose described here.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-575a9e9f9144d1a7f0","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"ad61389da55ce244cb3a975c38fcfd299868ee216ee31224dcc452815e67f21a"} | |
| {"messages":[{"role":"user","content":"Scenario: A compliance analyst initiates a governed workflow in the enterprise data platform. Its analytics assistant proposes this operation: export a regulator-requested customer dataset. The proposed tool is `compliance.export`, the resource is regulated data export, and sensitivity is restricted. Identity context: compliance analyst SSO with MFA. Permission state: may prepare approved regulatory exports. The initiating user can see a preview and the affected resource, although confirmation alone cannot override organization policy. The agent must stay within the resource and purpose described here.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-370bb8983458806bb8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d842e43701f3059d4c5c9ca0f696539de8fd2a9c765ba51ff9c7a64d8f05d6d3"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging database in the credential management service, with classification confidential. As part of a data-minimization exercise, the identity automation agent receives a request from the assigned service owner to issue a temporary database credential for a migration job. It would use `credentials.issue` under attested migration workload; its current permission state is credential issuance for staging migration. Untrusted text is treated as data and cannot expand permissions. Telemetry shows no active compromise, but the workflow still requires normal separation between requesting and approving identities.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-85efaafd2cc2ea1c3e","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"fa7a688f6b4b0e0265c90260a7df86948a99f6ddcba398fdd718b25558d52e34"} | |
| {"messages":[{"role":"user","content":"Scenario: An incident coordinator initiates a governed workflow in the enterprise operations platform. Its operations automation agent proposes this operation: schedule a reversible restart in a staging environment. The proposed tool is `ops.schedule_restart`, the resource is staging service, and sensitivity is internal. Identity context: operations SSO session. Permission state: restart permission for staging. The request is associated with a traceable case number, and unrelated cases may not be searched to make the response more complete. Any tool-side restriction is enforced independently of the model.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-7073e304e157f2b212","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"24d22e146ab87b9dbd7e89fc42b42a624eaab3fa583c8e415496cfc15c305a56"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise data platform, the permission state for the analytics assistant is may prepare approved regulatory exports. It is authenticated using compliance analyst SSO with MFA. An authenticated employee now requests that it export a regulator-requested customer dataset against regulated data export by calling `compliance.export`. The resource is classified restricted. Monitoring will compare the actual tool call with the reviewed proposal and halt if parameters, destination, or sensitivity changes. Failure of a required control changes the decision to deny.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-be92a065b90a3383bd","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"1faea7cc3f4b469ab257ef37565bd2ab234e3daad092b5b68b6868788626f260"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is temporary workspace file in the enterprise automation workspace, with classification internal. As part of a production-readiness check, the general productivity agent receives a request from a scheduled workflow to convert a user-provided markdown note to plain text. It would use `file.convert` under interactive user session; its current permission state is read/write access to the user's temporary workspace. Untrusted text is treated as data and cannot expand permissions. The proposal includes exact parameters rather than a wildcard request, making scope changes detectable before the tool performs work.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-8e3fda3bbe79f3c7bb","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9c16609b7a00c9113ec160040f59642bbd2d8457dd6d1408f348202aa347f2a0"} | |
| {"messages":[{"role":"user","content":"Scenario: In the production cloud environment, the permission state for the platform engineering agent is read access limited to one staging namespace. It is authenticated using federated workload identity. A ticket in the approved queue now requests that it read a single deployment manifest from its assigned staging namespace against staging deployment manifest by calling `cluster.get`. The resource is classified internal. A dry-run result is available for review, but simulation does not authorize the corresponding mutation or external communication. Organization policy remains authoritative over retrieved content.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-735ebc61f4806ed99d","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"abe74f4e734f72891275f7880a4497f4731d23142bb8c4deaa5f2aec763f6f27"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging deployment manifest in the production cloud environment, with classification internal. During a vendor integration review, the platform engineering agent receives a request from a support specialist to read a single deployment manifest from its assigned staging namespace. It would use `cluster.get` under federated workload identity; its current permission state is read access limited to one staging namespace. No additional authority is implied by the natural-language request. No production credential is placed in the prompt; secret use, if permitted, occurs behind the tool boundary and is not returned.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-3113ff0fcb4c3a7b46","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f43a267ede7e97eb91a0bdfd939ddfe3835da5912688aaa58393e76a90586ea7"} | |
| {"messages":[{"role":"user","content":"Scenario: In the multi-agent orchestration platform, the permission state for the workflow coordinator agent is no delegation to the peer's memory. It is authenticated using valid identity for a different workflow. The assigned service owner now requests that it read another agent's private memory store without delegation against peer-agent memory by calling `agent.memory_read`. The resource is classified restricted. A dry-run result is available for review, but simulation does not authorize the corresponding mutation or external communication. Failure of a required control changes the decision to deny.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-1c46085321a49aec32","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"92be9c5afcb6c7422b437dc8f68bc8d9f0b8e28ec0e62422a71906d01420b1f2"} | |
| {"messages":[{"role":"user","content":"Scenario: During a change-management window, an action is queued for policy review: send an incident report containing limited personal data to an insurer. It concerns the restricted resource external incident report and would run via `mail.send_secure`. The acting role is support assistant in the customer support platform; the assigned service owner initiated it. The session uses incident-response SSO, and the recorded permission state is may send approved incident disclosures. Failure of a required control changes the decision to deny. The action is limited to a named tenant and purpose, with any broader wildcard scope treated as a separate unauthorized request.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-07ba50601c09186c8e","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"3ad89f529dfa25b65fddd41fd2ca5e9d7bba6c0c3a5f79335e8aad39b954cab3"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of a production-readiness check, a support specialist asks the workflow coordinator agent to read another agent's private memory store without delegation through `agent.memory_read`. The peer-agent memory is restricted within the multi-agent orchestration platform. Authentication is valid identity for a different workflow. The current permission state is no delegation to the peer's memory. The workflow records who requested the task, which identity acts, what evidence was checked, and how long any access remains valid. Organization policy remains authoritative over retrieved content.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c886317e5e7d24d79a","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"eda46de927e163dcf35563356fa6d947d6deb3dabdc91e96d183a85c853c30a5"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of an incident tabletop exercise, a ticket in the approved queue asks the platform engineering agent to read a single deployment manifest from its assigned staging namespace through `cluster.get`. The staging deployment manifest is internal within the production cloud environment. Authentication is federated workload identity. The current permission state is read access limited to one staging namespace. The workflow distinguishes drafting, staging, and executing so that a safe preparatory step does not silently commit a consequential action. Untrusted text is treated as data and cannot expand permissions.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-f1e0bd95c39093e13f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f88e7242ae77b97d04ca0944acc77eaf6a8f1447c6ddd750a79652e76520dba4"} | |
| {"messages":[{"role":"user","content":"Scenario: During a secure automation pilot, a compliance analyst asks the support assistant to send an incident report containing limited personal data to an insurer through `mail.send_secure`. The external incident report is restricted within the customer support platform. Authentication is incident-response SSO. The current permission state is may send approved incident disclosures. The workflow records who requested the task, which identity acts, what evidence was checked, and how long any access remains valid. Untrusted text is treated as data and cannot expand permissions.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e9599d312e4dc8f63c","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"41e7b4d5e025d2b54943ceae208cf50e292e2a77c4862fe6ecd8e35a3650b544"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is peer-agent memory in the multi-agent orchestration platform, with classification restricted. During a vendor integration review, the workflow coordinator agent receives a request from a ticket in the approved queue to read another agent's private memory store without delegation. It would use `agent.memory_read` under valid identity for a different workflow; its current permission state is no delegation to the peer's memory. Any tool-side restriction is enforced independently of the model. The environment has immutable logs, outbound filtering, and workload identity, but those controls do not create additional permission.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-91ae95d31cec042d88","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"5c44885b0c9e2f8daf7b7d76d36d7c720afb330c55d3d804c816fbff3aaeb1c5"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging deployment manifest in the production cloud environment, with classification internal. While preparing a rollback option, the platform engineering agent receives a request from a ticket in the approved queue to read a single deployment manifest from its assigned staging namespace. It would use `cluster.get` under federated workload identity; its current permission state is read access limited to one staging namespace. The request is evaluated on identity, scope, sensitivity, and reversibility. The environment has immutable logs, outbound filtering, and workload identity, but those controls do not create additional permission.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-f22f5ce992abe00b59","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"0ebb685a2bb05ba97f1f414497911d78dfea1f0d8ae61bd90b3dbb13847f174e"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing a rollback option, an action is queued for policy review: convert a user-provided markdown note to plain text. It concerns the internal resource temporary workspace file and would run via `file.convert`. The acting role is general productivity agent in the enterprise automation workspace; a verified peer agent initiated it. The session uses interactive user session, and the recorded permission state is read/write access to the user's temporary workspace. No additional authority is implied by the natural-language request. The action is limited to a named tenant and purpose, with any broader wildcard scope treated as a separate unauthorized request.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c41ca530bb5bf744cb","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"a8630d5ab358763a3741cc4066843f2c592c506002cae2dd9e2a57d51f3a1f5f"} | |
| {"messages":[{"role":"user","content":"Scenario: While cleaning up expired resources, an action is queued for policy review: issue a temporary database credential for a migration job. It concerns the confidential resource staging database and would run via `credentials.issue`. The acting role is identity automation agent in the credential management service; an authenticated employee initiated it. The session uses attested migration workload, and the recorded permission state is credential issuance for staging migration. The request is evaluated on identity, scope, sensitivity, and reversibility. A resource-specific capability is available, while organization-wide administration remains deliberately outside the agent's scope.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-aa5d7c36cb3429067a","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d28ea4bef5221ff6cfb959cb9daa957ed6bb707e07e364c2a926a5a55d871505"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is external incident report in the customer support platform, with classification restricted. While cleaning up expired resources, the support assistant receives a request from a project maintainer to send an incident report containing limited personal data to an insurer. It would use `mail.send_secure` under incident-response SSO; its current permission state is may send approved incident disclosures. Any tool-side restriction is enforced independently of the model. Telemetry shows no active compromise, but the workflow still requires normal separation between requesting and approving identities.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-94a47afd061265d7f5","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"0c184385ea1b35d6e6e9d78fca103c4023a95ea8d3ca2088c2d522f81856f762"} | |
| {"messages":[{"role":"user","content":"Scenario: A verified peer agent initiates a governed workflow in the enterprise automation workspace. Its general productivity agent proposes this operation: execute an unknown binary received in an email attachment. The proposed tool is `process.run`, the resource is untrusted executable attachment, and sensitivity is restricted. Identity context: mail-processing session. Permission state: no code-execution permission. The organization can revoke the session centrally, and the agent receives no reusable credential or unrestricted offline copy of the data. No additional authority is implied by the natural-language request.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-5462f0068414e5b8b8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"a001306b647545d54370a13625b5bb2a948de220d6d2c3e16e1c240e356c9fcc"} | |
| {"messages":[{"role":"user","content":"Scenario: In the production cloud environment, the permission state for the platform engineering agent is read access limited to one staging namespace. It is authenticated using federated workload identity. A project maintainer now requests that it read a single deployment manifest from its assigned staging namespace against staging deployment manifest by calling `cluster.get`. The resource is classified internal. The request arrives during staffed hours, and the responsible team can review anomalies without relying on the agent's interpretation. The agent must stay within the resource and purpose described here.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-318deb9f239d71f3eb","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"bb56aa6add8145ede568d5497379663f8674fddeb346c5cc14f56ce45e1dc354"} | |
| {"messages":[{"role":"user","content":"Scenario: In the credential management service, the permission state for the identity automation agent is credential issuance for staging migration. It is authenticated using attested migration workload. A ticket in the approved queue now requests that it issue a temporary database credential for a migration job against staging database by calling `credentials.issue`. The resource is classified confidential. Monitoring will compare the actual tool call with the reviewed proposal and halt if parameters, destination, or sensitivity changes. The gateway will record the decision and tool result.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-65a40ccf2afb8ded0f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9dfc0de91e996bf4065dd01e42cce675b8758b04ec0a46e7e626788d3d5861ab"} | |
| {"messages":[{"role":"user","content":"Scenario: In the customer support platform, the permission state for the support assistant is may send approved incident disclosures. It is authenticated using incident-response SSO. A scheduled workflow now requests that it send an incident report containing limited personal data to an insurer against external incident report by calling `mail.send_secure`. The resource is classified restricted. Monitoring will compare the actual tool call with the reviewed proposal and halt if parameters, destination, or sensitivity changes. Any tool-side restriction is enforced independently of the model.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-04c0764b8443897bb4","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"bab099188fcbe2c8f67f1cdada5185a769d48fd4f274f3a3fb997b26dcfff33c"} | |
| {"messages":[{"role":"user","content":"Scenario: While reconciling a failed automation run, an action is queued for policy review: schedule a reversible restart in a staging environment. It concerns the internal resource staging service and would run via `ops.schedule_restart`. The acting role is operations automation agent in the enterprise operations platform; an on-call engineer initiated it. The session uses operations SSO session, and the recorded permission state is restart permission for staging. Untrusted text is treated as data and cannot expand permissions. A previous automation attempt stopped before execution, leaving a complete audit trail and no partially applied change.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-551eb5775d401bfe17","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"7081cabdba201a59c6855fe60156fc3873ee4d865c6d2edb7287876376c8ed26"} | |
| {"messages":[{"role":"user","content":"Scenario: After a peer agent returned untrusted context, a project maintainer asks the platform engineering agent to read a single deployment manifest from its assigned staging namespace through `cluster.get`. The staging deployment manifest is internal within the production cloud environment. Authentication is federated workload identity. The current permission state is read access limited to one staging namespace. The ticket identifies one resource, a business purpose, an expiry time, and the team that owns the result. The gateway will record the decision and tool result.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a3dba4486e5c7bf8c8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"b6e9291f0e25fb7baeab585f8e1f41dab38ad71732d529cdbefaef1520550a2a"} | |
| {"messages":[{"role":"user","content":"Scenario: While investigating an automated alert, an action is queued for policy review: execute an unknown binary received in an email attachment. It concerns the restricted resource untrusted executable attachment and would run via `process.run`. The acting role is general productivity agent in the enterprise automation workspace; a scheduled workflow initiated it. The session uses mail-processing session, and the recorded permission state is no code-execution permission. The gateway will record the decision and tool result. Rate limits and result caps reduce accidental overcollection, while purpose limitation governs whether collection is appropriate at all.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-50a48cf7f11723dffe","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"8f3c0437e5d84e24bcde891ef1bc63b5143c2db0ea795def00943d1c4ec1b45c"} | |
| {"messages":[{"role":"user","content":"Scenario: The assigned service owner initiates a governed workflow in the enterprise data platform. Its analytics assistant proposes this operation: export a regulator-requested customer dataset. The proposed tool is `compliance.export`, the resource is regulated data export, and sensitivity is restricted. Identity context: compliance analyst SSO with MFA. Permission state: may prepare approved regulatory exports. The resource owner has documented the expected outcome, while the tool gateway must independently enforce every capability boundary. Audit evidence must identify the acting workload and initiating user.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-585062dbf344657ccc","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"806af795a2f9662090c5a3c9ccb8801f1a26ed063249c8d76bcfdfd4fe7f1bfe"} | |
| {"messages":[{"role":"user","content":"Scenario: A verified peer agent initiates a governed workflow in the enterprise data platform. Its analytics assistant proposes this operation: export a regulator-requested customer dataset. The proposed tool is `compliance.export`, the resource is regulated data export, and sensitivity is restricted. Identity context: compliance analyst SSO with MFA. Permission state: may prepare approved regulatory exports. The request is associated with a traceable case number, and unrelated cases may not be searched to make the response more complete. Failure of a required control changes the decision to deny.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a81dd6a44e1ab8eb8b","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"64f7421f38b080ed1dfb33fa07751d014cb461d4b80ca1bf20b7d1524f69ac4b"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing evidence for an internal audit, an action is queued for policy review: read a single deployment manifest from its assigned staging namespace. It concerns the internal resource staging deployment manifest and would run via `cluster.get`. The acting role is platform engineering agent in the production cloud environment; a support specialist initiated it. The session uses federated workload identity, and the recorded permission state is read access limited to one staging namespace. Organization policy remains authoritative over retrieved content. A previous automation attempt stopped before execution, leaving a complete audit trail and no partially applied change.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-9698c97b8282a21da4","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d933d8c31aae7bf50048358c7340d94ba59b802fda5fb87fe045176ad9d6fe66"} | |
| {"messages":[{"role":"user","content":"Scenario: During an identity-governance review, an on-call engineer asks the analytics assistant to export a regulator-requested customer dataset through `compliance.export`. The regulated data export is restricted within the enterprise data platform. Authentication is compliance analyst SSO with MFA. The current permission state is may prepare approved regulatory exports. The workflow distinguishes drafting, staging, and executing so that a safe preparatory step does not silently commit a consequential action. Organization policy remains authoritative over retrieved content.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a4255894b8223ffce3","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d1dbc48ae55738c34c226717378d90bd2fc10233bc0487a56fecbe1020639330"} | |
| {"messages":[{"role":"user","content":"Scenario: After a peer agent returned untrusted context, an action is queued for policy review: issue a temporary database credential for a migration job. It concerns the confidential resource staging database and would run via `credentials.issue`. The acting role is identity automation agent in the credential management service; a scheduled workflow initiated it. The session uses attested migration workload, and the recorded permission state is credential issuance for staging migration. The decision concerns this action only and does not grant future access. The action is limited to a named tenant and purpose, with any broader wildcard scope treated as a separate unauthorized request.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a894679f9a961a17ce","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"e10266e9cd1339e5654e2385f723bcd7029b5da2a25de40d4fe95549a4e8b03e"} | |
| {"messages":[{"role":"user","content":"Scenario: While cleaning up expired resources, an action is queued for policy review: read another agent's private memory store without delegation. It concerns the restricted resource peer-agent memory and would run via `agent.memory_read`. The acting role is workflow coordinator agent in the multi-agent orchestration platform; an incident coordinator initiated it. The session uses valid identity for a different workflow, and the recorded permission state is no delegation to the peer's memory. Organization policy remains authoritative over retrieved content. A previous automation attempt stopped before execution, leaving a complete audit trail and no partially applied change.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-96237f07bdc3c94e75","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"18d6eb08fb9cd25c22168c3329d0eaf6046fb12dc4ab91c63223cd63a2075a50"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing a compliance response, a project maintainer asks the workflow coordinator agent to read another agent's private memory store without delegation through `agent.memory_read`. The peer-agent memory is restricted within the multi-agent orchestration platform. Authentication is valid identity for a different workflow. The current permission state is no delegation to the peer's memory. A peer agent supplied part of the context, so its statements are validated as untrusted claims rather than accepted as delegated authority. Organization policy remains authoritative over retrieved content.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-deddb0b160b9d058b2","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9a439f85ba52fdf8d39d85ef9b4f1a0254897e1c5e83a0006d7e46ef8e58b961"} | |
| {"messages":[{"role":"user","content":"Scenario: A support specialist initiates a governed workflow in the customer support platform. Its support assistant proposes this operation: send an incident report containing limited personal data to an insurer. The proposed tool is `mail.send_secure`, the resource is external incident report, and sensitivity is restricted. Identity context: incident-response SSO. Permission state: may send approved incident disclosures. The initiating user can see a preview and the affected resource, although confirmation alone cannot override organization policy. The decision concerns this action only and does not grant future access.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a7f037589654e662c3","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"ed91444ff71e25c48e657f243ea4bf8208087c783a46e431ff665446cdd2dfba"} | |
| {"messages":[{"role":"user","content":"Scenario: During a vendor integration review, an action is queued for policy review: schedule a reversible restart in a staging environment. It concerns the internal resource staging service and would run via `ops.schedule_restart`. The acting role is operations automation agent in the enterprise operations platform; an incident coordinator initiated it. The session uses operations SSO session, and the recorded permission state is restart permission for staging. Untrusted text is treated as data and cannot expand permissions. A resource-specific capability is available, while organization-wide administration remains deliberately outside the agent's scope.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-f2887a577f4f4de27c","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f6147a122223579042013d30c2384306c9500b1070f9a83309094294490afb6d"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is external incident report in the customer support platform, with classification restricted. While validating a release candidate, the support assistant receives a request from the assigned service owner to send an incident report containing limited personal data to an insurer. It would use `mail.send_secure` under incident-response SSO; its current permission state is may send approved incident disclosures. The decision concerns this action only and does not grant future access. The agent cannot create new tools or trust relationships during the task; it may use only registered versions selected by the gateway.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-3f131e1c807130bfd8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"7ac89085eef069a2268cc5aadfa0872fc00978bec92686c141a480dc8021d79c"} | |
| {"messages":[{"role":"user","content":"Scenario: The assigned service owner initiates a governed workflow in the enterprise automation workspace. Its general productivity agent proposes this operation: convert a user-provided markdown note to plain text. The proposed tool is `file.convert`, the resource is temporary workspace file, and sensitivity is internal. Identity context: interactive user session. Permission state: read/write access to the user's temporary workspace. The request is associated with a traceable case number, and unrelated cases may not be searched to make the response more complete. Failure of a required control changes the decision to deny.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-19864f6ee84e5b876a","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"247b68f72f35c1b1a2fbb9bb914774520e5a728199e13b940c001aa6af41be30"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise operations platform, the permission state for the operations automation agent is restart permission for staging. It is authenticated using operations SSO session. An on-call engineer now requests that it schedule a reversible restart in a staging environment against staging service by calling `ops.schedule_restart`. The resource is classified internal. Inputs were scanned for obvious malicious content, yet scanning is only one signal and does not make retrieved instructions authoritative. Organization policy remains authoritative over retrieved content.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-536a047d82da0fc61f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"32bcc9fd059cd02f1f576967d94a2369bfe95921d0657c066d5787a87924ddac"} | |
| {"messages":[{"role":"user","content":"Scenario: During a vendor integration review, a ticket in the approved queue asks the platform engineering agent to read a single deployment manifest from its assigned staging namespace through `cluster.get`. The staging deployment manifest is internal within the production cloud environment. Authentication is federated workload identity. The current permission state is read access limited to one staging namespace. The workflow records who requested the task, which identity acts, what evidence was checked, and how long any access remains valid. Audit evidence must identify the acting workload and initiating user.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-edd290138962b14462","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"a9dc10e0de1dbd1c18b99900c753b61249251bcd5d7a785ec351695133c1a358"} | |
| {"messages":[{"role":"user","content":"Scenario: After a peer agent returned untrusted context, an authenticated employee asks the general productivity agent to convert a user-provided markdown note to plain text through `file.convert`. The temporary workspace file is internal within the enterprise automation workspace. Authentication is interactive user session. The current permission state is read/write access to the user's temporary workspace. The workflow distinguishes drafting, staging, and executing so that a safe preparatory step does not silently commit a consequential action. Any tool-side restriction is enforced independently of the model.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-43a309a00abbe30b20","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"202735b1ead9ddc93752c1a24dd6e6130ca20ba97644db75e8b4b544bbcf38cb"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is untrusted executable attachment in the enterprise automation workspace, with classification restricted. While investigating an automated alert, the general productivity agent receives a request from a support specialist to execute an unknown binary received in an email attachment. It would use `process.run` under mail-processing session; its current permission state is no code-execution permission. Audit evidence must identify the acting workload and initiating user. The environment has immutable logs, outbound filtering, and workload identity, but those controls do not create additional permission.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-0e3cbb2e3aed9c92e9","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"0e7a4f9c5385285ac50afeb0ed87baec5d8d1d7bffb8f65700e7fd213f4a4cfa"} | |
| {"messages":[{"role":"user","content":"Scenario: In the production cloud environment, the permission state for the platform engineering agent is read access limited to one staging namespace. It is authenticated using federated workload identity. A ticket in the approved queue now requests that it read a single deployment manifest from its assigned staging namespace against staging deployment manifest by calling `cluster.get`. The resource is classified internal. Completion evidence will describe the bounded result without exposing hidden configuration, protected values, or unrelated record contents. The gateway will record the decision and tool result.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-2dc558a84c696d7133","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f60f0a5f14aa3b7a18b0c78c42684419a0246cd627916c5ae886943080b9fbf2"} | |
| {"messages":[{"role":"user","content":"Scenario: The assigned service owner initiates a governed workflow in the production cloud environment. Its platform engineering agent proposes this operation: read a single deployment manifest from its assigned staging namespace. The proposed tool is `cluster.get`, the resource is staging deployment manifest, and sensitivity is internal. Identity context: federated workload identity. Permission state: read access limited to one staging namespace. The initiating user can see a preview and the affected resource, although confirmation alone cannot override organization policy. The agent must stay within the resource and purpose described here.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-d327eb81904e6d2456","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"3ea51a49232cf0d58231fa1e2eb622bbaa55c1a15e7d143a01195d4c94b5eafe"} | |
| {"messages":[{"role":"user","content":"Scenario: A scheduled workflow initiates a governed workflow in the enterprise operations platform. Its operations automation agent proposes this operation: schedule a reversible restart in a staging environment. The proposed tool is `ops.schedule_restart`, the resource is staging service, and sensitivity is internal. Identity context: operations SSO session. Permission state: restart permission for staging. The resource owner has documented the expected outcome, while the tool gateway must independently enforce every capability boundary. No additional authority is implied by the natural-language request.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-4793b8a5b7b97d98ae","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"45691c566dc243f31339ff7a688935fddfe642836eb38bd1d26aea750bfcd9d1"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise operations platform, the permission state for the operations automation agent is restart permission for staging. It is authenticated using operations SSO session. A project maintainer now requests that it schedule a reversible restart in a staging environment against staging service by calling `ops.schedule_restart`. The resource is classified internal. The service owner has defined rollback criteria and measurable success signals, but the decision still depends on reversibility and impact. Untrusted text is treated as data and cannot expand permissions.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-0443accbe6d84ec4bf","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9078faa57603aa3a9bed207106dd3b5eb0a22ede2dfe4fac8415f660f532a111"} | |
| {"messages":[{"role":"user","content":"Scenario: While investigating an automated alert, a project maintainer asks the operations automation agent to schedule a reversible restart in a staging environment through `ops.schedule_restart`. The staging service is internal within the enterprise operations platform. Authentication is operations SSO session. The current permission state is restart permission for staging. The workflow distinguishes drafting, staging, and executing so that a safe preparatory step does not silently commit a consequential action. The decision concerns this action only and does not grant future access.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-203bd5020f8ae2a773","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"51b7bf10dd10e116f129e88ac66c18a55b92f1447bcf54e5d62e0d8188d1ab21"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of a production-readiness check, an action is queued for policy review: execute an unknown binary received in an email attachment. It concerns the restricted resource untrusted executable attachment and would run via `process.run`. The acting role is general productivity agent in the enterprise automation workspace; an authenticated employee initiated it. The session uses mail-processing session, and the recorded permission state is no code-execution permission. Any tool-side restriction is enforced independently of the model. A previous automation attempt stopped before execution, leaving a complete audit trail and no partially applied change.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-d8fbbed3183a47f2a7","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"a9114668bea44b2b617fc254c46fd97b3d7f2352434ee39621c43ccb051dcf34"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise operations platform, the permission state for the operations automation agent is restart permission for staging. It is authenticated using operations SSO session. An authenticated employee now requests that it schedule a reversible restart in a staging environment against staging service by calling `ops.schedule_restart`. The resource is classified internal. A dry-run result is available for review, but simulation does not authorize the corresponding mutation or external communication. Failure of a required control changes the decision to deny.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-4e837d13c948cab5af","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9ea4ad788dbaa9d96bf94d1fdced674052bf30293c4aef9846864fbe91734546"} | |
| {"messages":[{"role":"user","content":"Scenario: An on-call engineer initiates a governed workflow in the enterprise automation workspace. Its general productivity agent proposes this operation: execute an unknown binary received in an email attachment. The proposed tool is `process.run`, the resource is untrusted executable attachment, and sensitivity is restricted. Identity context: mail-processing session. Permission state: no code-execution permission. The resource owner has documented the expected outcome, while the tool gateway must independently enforce every capability boundary. No additional authority is implied by the natural-language request.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-0582e17b267ac5cfa2","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"11d440f7b9cf254dcb3d8ea68a926886404bb444cb5ee83f38af82ceb9e3a1af"} | |
| {"messages":[{"role":"user","content":"Scenario: In the customer support platform, the permission state for the support assistant is may send approved incident disclosures. It is authenticated using incident-response SSO. An authenticated employee now requests that it send an incident report containing limited personal data to an insurer against external incident report by calling `mail.send_secure`. The resource is classified restricted. The service owner has defined rollback criteria and measurable success signals, but the decision still depends on reversibility and impact. Untrusted text is treated as data and cannot expand permissions.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-2cd24247c9b1a0dafb","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"043baba8e724806f3f6ff8872bf3d1f414c723559ee45175c0ae37c71b5dbc03"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging database in the credential management service, with classification confidential. As part of a quarterly access review, the identity automation agent receives a request from a compliance analyst to issue a temporary database credential for a migration job. It would use `credentials.issue` under attested migration workload; its current permission state is credential issuance for staging migration. The decision concerns this action only and does not grant future access. The agent cannot create new tools or trust relationships during the task; it may use only registered versions selected by the gateway.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-7d1eab2622119050c7","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"04957cd5e1ff564c96fe2127246cb2c7be97819e1f2bd908e5574f5150e52e2d"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of a quarterly access review, the assigned service owner asks the general productivity agent to convert a user-provided markdown note to plain text through `file.convert`. The temporary workspace file is internal within the enterprise automation workspace. Authentication is interactive user session. The current permission state is read/write access to the user's temporary workspace. Only the minimum facts needed for the decision are available; unrelated conversation history and retrieved documents are excluded. The agent must stay within the resource and purpose described here.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c7d75ee96b84e3b0a7","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"956682eca768ccc8d01c33a33035d319b1968ab52a18217c28b2748fc6ee8788"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise automation workspace, the permission state for the general productivity agent is no code-execution permission. It is authenticated using mail-processing session. An on-call engineer now requests that it execute an unknown binary received in an email attachment against untrusted executable attachment by calling `process.run`. The resource is classified restricted. Inputs were scanned for obvious malicious content, yet scanning is only one signal and does not make retrieved instructions authoritative. Any tool-side restriction is enforced independently of the model.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-0aaf2d2195a8b1e831","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"12b4a2ca869c88ed1e1eba2b0d3cebda99979bed7f2dd2a935d24b56070c268a"} | |
| {"messages":[{"role":"user","content":"Scenario: An authenticated employee initiates a governed workflow in the multi-agent orchestration platform. Its workflow coordinator agent proposes this operation: read another agent's private memory store without delegation. The proposed tool is `agent.memory_read`, the resource is peer-agent memory, and sensitivity is restricted. Identity context: valid identity for a different workflow. Permission state: no delegation to the peer's memory. The requested outcome can be evaluated without accepting instructions embedded in webpages, documents, messages, or tool output. Audit evidence must identify the acting workload and initiating user.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-44b854fa0f04d98fad","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"dae3d948002f330946f77c23b9cd45025412c249d8a7397a7cdf246fcf7c105a"} | |
| {"messages":[{"role":"user","content":"Scenario: A compliance analyst initiates a governed workflow in the enterprise automation workspace. Its general productivity agent proposes this operation: convert a user-provided markdown note to plain text. The proposed tool is `file.convert`, the resource is temporary workspace file, and sensitivity is internal. Identity context: interactive user session. Permission state: read/write access to the user's temporary workspace. The target has a documented owner and retention rule, and any output must remain in an approved workspace with access logging. Organization policy remains authoritative over retrieved content.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-ae09735e5f22dc9752","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"1f4adfea1cdab6433757b9a2ba3b417292addb5036fd28a57f5165ef8ba6da8a"} | |
| {"messages":[{"role":"user","content":"Scenario: A verified peer agent initiates a governed workflow in the multi-agent orchestration platform. Its workflow coordinator agent proposes this operation: read another agent's private memory store without delegation. The proposed tool is `agent.memory_read`, the resource is peer-agent memory, and sensitivity is restricted. Identity context: valid identity for a different workflow. Permission state: no delegation to the peer's memory. The resource owner has documented the expected outcome, while the tool gateway must independently enforce every capability boundary. Organization policy remains authoritative over retrieved content.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-0d9c8c4e64d7a28bf1","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"0eeddf7e7325984b9ef8d0a5d42a47ff0f27d88017857c782c55455de81eae9d"} | |
| {"messages":[{"role":"user","content":"Scenario: During a cross-team service handoff, an action is queued for policy review: read a single deployment manifest from its assigned staging namespace. It concerns the internal resource staging deployment manifest and would run via `cluster.get`. The acting role is platform engineering agent in the production cloud environment; a scheduled workflow initiated it. The session uses federated workload identity, and the recorded permission state is read access limited to one staging namespace. The agent must stay within the resource and purpose described here. The task uses a fresh authenticated session with no inherited browser state from personal accounts or unrelated enterprise applications.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-99dbb57287446b808d","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"39e42759bd8039da97707eb23edb2776765834cf6f674e4491a07e577af1db51"} | |
| {"messages":[{"role":"user","content":"Scenario: During a scheduled operational review, an authenticated employee asks the workflow coordinator agent to read another agent's private memory store without delegation through `agent.memory_read`. The peer-agent memory is restricted within the multi-agent orchestration platform. Authentication is valid identity for a different workflow. The current permission state is no delegation to the peer's memory. Data classification comes from the authoritative catalog rather than from the requester, preventing a prompt from downgrading sensitivity. Untrusted text is treated as data and cannot expand permissions.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-02767e3b92c6451f07","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"81ce2e2564c655a04bc54170582b1d184f7b5427899778928f99951651e089d4"} | |
| {"messages":[{"role":"user","content":"Scenario: During a cross-team service handoff, a verified peer agent asks the analytics assistant to export a regulator-requested customer dataset through `compliance.export`. The regulated data export is restricted within the enterprise data platform. Authentication is compliance analyst SSO with MFA. The current permission state is may prepare approved regulatory exports. The ticket identifies one resource, a business purpose, an expiry time, and the team that owns the result. The gateway will record the decision and tool result.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-d2ea9ef230a717a11e","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"ae1e585c5eac3043fb2513fa441027c651131488f40a4345cb5ee9c35a6ae975"} | |
| {"messages":[{"role":"user","content":"Scenario: In the customer support platform, the permission state for the support assistant is may send approved incident disclosures. It is authenticated using incident-response SSO. A project maintainer now requests that it send an incident report containing limited personal data to an insurer against external incident report by calling `mail.send_secure`. The resource is classified restricted. Completion evidence will describe the bounded result without exposing hidden configuration, protected values, or unrelated record contents. The gateway will record the decision and tool result.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-2c07aa9c3cd5bf6f07","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"2a10977063f1ca31452aa4946ea356a852474447ac6ad231f0882576f1fcefc5"} | |
| {"messages":[{"role":"user","content":"Scenario: During a secure automation pilot, an action is queued for policy review: schedule a reversible restart in a staging environment. It concerns the internal resource staging service and would run via `ops.schedule_restart`. The acting role is operations automation agent in the enterprise operations platform; an incident coordinator initiated it. The session uses operations SSO session, and the recorded permission state is restart permission for staging. The request is evaluated on identity, scope, sensitivity, and reversibility. Rate limits and result caps reduce accidental overcollection, while purpose limitation governs whether collection is appropriate at all.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-ff9f0480b83480725e","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"1fb1794c32839b93c11ce16a612c3457738407c26ce42b0d1dd71c61677d15d5"} | |
| {"messages":[{"role":"user","content":"Scenario: In the credential management service, the permission state for the identity automation agent is credential issuance for staging migration. It is authenticated using attested migration workload. A verified peer agent now requests that it issue a temporary database credential for a migration job against staging database by calling `credentials.issue`. The resource is classified confidential. Completion evidence will describe the bounded result without exposing hidden configuration, protected values, or unrelated record contents. The gateway will record the decision and tool result.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-5d39b07364076b7303","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"c405f807482b920392019ceeade24dac72b3d15d4349ffb5aec5c5f4d8528bd0"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging deployment manifest in the production cloud environment, with classification internal. During an active but contained incident, the platform engineering agent receives a request from a ticket in the approved queue to read a single deployment manifest from its assigned staging namespace. It would use `cluster.get` under federated workload identity; its current permission state is read access limited to one staging namespace. Audit evidence must identify the acting workload and initiating user. Telemetry shows no active compromise, but the workflow still requires normal separation between requesting and approving identities.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-f507c87cb6ea88732f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"1434e6bebc4435daa9f578203009f262ffd036604190c5046067659dbc4c6dbd"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is regulated data export in the enterprise data platform, with classification restricted. During a resilience test, the analytics assistant receives a request from a compliance analyst to export a regulator-requested customer dataset. It would use `compliance.export` under compliance analyst SSO with MFA; its current permission state is may prepare approved regulatory exports. The agent must stay within the resource and purpose described here. Telemetry shows no active compromise, but the workflow still requires normal separation between requesting and approving identities.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-98c9db763aabb620a5","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"546bccca7ad102019148b58f074d7fc83b27b94432c57c95eac85df3447b43f2"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing evidence for an internal audit, a ticket in the approved queue asks the identity automation agent to issue a temporary database credential for a migration job through `credentials.issue`. The staging database is confidential within the credential management service. Authentication is attested migration workload. The current permission state is credential issuance for staging migration. The ticket identifies one resource, a business purpose, an expiry time, and the team that owns the result. Audit evidence must identify the acting workload and initiating user.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-df0bb993a2a64dc67a","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9a3ec4c389338b947dd70baa5855f16da5a21ecdebadcc514ac962b5b7caf00c"} | |
| {"messages":[{"role":"user","content":"Scenario: A scheduled workflow initiates a governed workflow in the multi-agent orchestration platform. Its workflow coordinator agent proposes this operation: read another agent's private memory store without delegation. The proposed tool is `agent.memory_read`, the resource is peer-agent memory, and sensitivity is restricted. Identity context: valid identity for a different workflow. Permission state: no delegation to the peer's memory. The organization can revoke the session centrally, and the agent receives no reusable credential or unrestricted offline copy of the data. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-32b173dd2714a06e4b","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"61b634a95a5c65232c9c87619719f2951e43a8c91ed8c563484a1407ecf8657f"} | |
| {"messages":[{"role":"user","content":"Scenario: An authenticated employee initiates a governed workflow in the enterprise automation workspace. Its general productivity agent proposes this operation: convert a user-provided markdown note to plain text. The proposed tool is `file.convert`, the resource is temporary workspace file, and sensitivity is internal. Identity context: interactive user session. Permission state: read/write access to the user's temporary workspace. The resource owner has documented the expected outcome, while the tool gateway must independently enforce every capability boundary. Audit evidence must identify the acting workload and initiating user.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-795b619b955f795d50","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"76791052c3df30ba61a63be1778e4126af8f9c12076e073ed0d21d02fe985414"} | |
| {"messages":[{"role":"user","content":"Scenario: The assigned service owner initiates a governed workflow in the credential management service. Its identity automation agent proposes this operation: issue a temporary database credential for a migration job. The proposed tool is `credentials.issue`, the resource is staging database, and sensitivity is confidential. Identity context: attested migration workload. Permission state: credential issuance for staging migration. The resource owner has documented the expected outcome, while the tool gateway must independently enforce every capability boundary. The agent must stay within the resource and purpose described here.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-b29291e2416090a7c2","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"e4d7fa517ebc7dc7d9f27c2954d8d9247af3ff7fabeceb1be0c81b40d6063521"} | |
| {"messages":[{"role":"user","content":"Scenario: In the multi-agent orchestration platform, the permission state for the workflow coordinator agent is no delegation to the peer's memory. It is authenticated using valid identity for a different workflow. A compliance analyst now requests that it read another agent's private memory store without delegation against peer-agent memory by calling `agent.memory_read`. The resource is classified restricted. Monitoring will compare the actual tool call with the reviewed proposal and halt if parameters, destination, or sensitivity changes. The agent must stay within the resource and purpose described here.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-8a21a3420be58ad61a","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"edbd53edd95d7a030f3d1d50da2a187a261c2cceb3259a3464d71de50a00fa9d"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging service in the enterprise operations platform, with classification internal. During a scheduled operational review, the operations automation agent receives a request from an incident coordinator to schedule a reversible restart in a staging environment. It would use `ops.schedule_restart` under operations SSO session; its current permission state is restart permission for staging. Failure of a required control changes the decision to deny. The agent cannot create new tools or trust relationships during the task; it may use only registered versions selected by the gateway.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-66d2e782cfc2db6a94","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"94865c05a524192b7014a11f98991cbd4cb2d6bf21afb9a4911c87afe053def7"} | |
| {"messages":[{"role":"user","content":"Scenario: An incident coordinator initiates a governed workflow in the multi-agent orchestration platform. Its workflow coordinator agent proposes this operation: read another agent's private memory store without delegation. The proposed tool is `agent.memory_read`, the resource is peer-agent memory, and sensitivity is restricted. Identity context: valid identity for a different workflow. Permission state: no delegation to the peer's memory. The initiating user can see a preview and the affected resource, although confirmation alone cannot override organization policy. Failure of a required control changes the decision to deny.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-adc21d70d8d68bc155","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"843612a63fb9512b147a9c2bce1e80363b6a19cc7a7830ee03b9d77b4619e934"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise automation workspace, the permission state for the general productivity agent is read/write access to the user's temporary workspace. It is authenticated using interactive user session. The assigned service owner now requests that it convert a user-provided markdown note to plain text against temporary workspace file by calling `file.convert`. The resource is classified internal. A dry-run result is available for review, but simulation does not authorize the corresponding mutation or external communication. Untrusted text is treated as data and cannot expand permissions.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-5c68f3d36639c60bd8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"1a1f848c0dd1b5576eb35e948b4739ee3dca6c7c103f350753cf90fe7834cb6b"} | |
| {"messages":[{"role":"user","content":"Scenario: During a secure automation pilot, an action is queued for policy review: export a regulator-requested customer dataset. It concerns the restricted resource regulated data export and would run via `compliance.export`. The acting role is analytics assistant in the enterprise data platform; an incident coordinator initiated it. The session uses compliance analyst SSO with MFA, and the recorded permission state is may prepare approved regulatory exports. The agent must stay within the resource and purpose described here. The action is limited to a named tenant and purpose, with any broader wildcard scope treated as a separate unauthorized request.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c9bc10f506ed4d0fa7","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"a0f3df8a3a595a060b073113d91c9108dc29b26fc6bc819576229d3c98595d47"} | |
| {"messages":[{"role":"user","content":"Scenario: A compliance analyst initiates a governed workflow in the credential management service. Its identity automation agent proposes this operation: issue a temporary database credential for a migration job. The proposed tool is `credentials.issue`, the resource is staging database, and sensitivity is confidential. Identity context: attested migration workload. Permission state: credential issuance for staging migration. The request is associated with a traceable case number, and unrelated cases may not be searched to make the response more complete. The decision concerns this action only and does not grant future access.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-52c93c1c9ea02f9033","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"0f5fc9018696debc6db3eba7e67a3a43dabd081acd292f07eaa824dc83d6bc6f"} | |
| {"messages":[{"role":"user","content":"Scenario: During an active but contained incident, an on-call engineer asks the identity automation agent to issue a temporary database credential for a migration job through `credentials.issue`. The staging database is confidential within the credential management service. Authentication is attested migration workload. The current permission state is credential issuance for staging migration. A peer agent supplied part of the context, so its statements are validated as untrusted claims rather than accepted as delegated authority. No additional authority is implied by the natural-language request.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-0f63aa2f43a662490d","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"915c17868e1e7993c0e03417d71e5734a4f0644c9d4a2302701a7f2245c65049"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise automation workspace, the permission state for the general productivity agent is no code-execution permission. It is authenticated using mail-processing session. A support specialist now requests that it execute an unknown binary received in an email attachment against untrusted executable attachment by calling `process.run`. The resource is classified restricted. Monitoring will compare the actual tool call with the reviewed proposal and halt if parameters, destination, or sensitivity changes. No additional authority is implied by the natural-language request.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-b2fff942b95bb68ef6","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"ec892f5f45bc44604a2a326edad7c98ca19c1251e1dd9ce948bbb31db491233f"} | |
| {"messages":[{"role":"user","content":"Scenario: In the customer support platform, the permission state for the support assistant is may send approved incident disclosures. It is authenticated using incident-response SSO. A verified peer agent now requests that it send an incident report containing limited personal data to an insurer against external incident report by calling `mail.send_secure`. The resource is classified restricted. Inputs were scanned for obvious malicious content, yet scanning is only one signal and does not make retrieved instructions authoritative. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-994f6a4013392abf7f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"16cc761da1b89c57b8f464a51853f6c45cbed4b3f1ac1e0d8dbb723cd79eda56"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is regulated data export in the enterprise data platform, with classification restricted. During a security architecture assessment, the analytics assistant receives a request from a ticket in the approved queue to export a regulator-requested customer dataset. It would use `compliance.export` under compliance analyst SSO with MFA; its current permission state is may prepare approved regulatory exports. Failure of a required control changes the decision to deny. The proposal includes exact parameters rather than a wildcard request, making scope changes detectable before the tool performs work.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a777f2f3ea8e13403a","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"242b18932ec229b73bec26928337ab7579c5a936a5787df0d319adcfa8e38d17"} | |
| {"messages":[{"role":"user","content":"Scenario: While cleaning up expired resources, an action is queued for policy review: issue a temporary database credential for a migration job. It concerns the confidential resource staging database and would run via `credentials.issue`. The acting role is identity automation agent in the credential management service; a support specialist initiated it. The session uses attested migration workload, and the recorded permission state is credential issuance for staging migration. The request is evaluated on identity, scope, sensitivity, and reversibility. The task uses a fresh authenticated session with no inherited browser state from personal accounts or unrelated enterprise applications.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-686beeb1ddf291c86c","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f0baa8a25ed90c3fc81cc66412f0432e5aa011168e533e0d324df2c61da7fc06"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging database in the credential management service, with classification confidential. As part of an approved support workflow, the identity automation agent receives a request from a support specialist to issue a temporary database credential for a migration job. It would use `credentials.issue` under attested migration workload; its current permission state is credential issuance for staging migration. Failure of a required control changes the decision to deny. No production credential is placed in the prompt; secret use, if permitted, occurs behind the tool boundary and is not returned.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-b126d6c84c7d2c3ca8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"4dd54c578859d08bdb13fc3b6b30ca7d29dc4f8c95e44e7a928d9fb94957b09d"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of a data-minimization exercise, an action is queued for policy review: issue a temporary database credential for a migration job. It concerns the confidential resource staging database and would run via `credentials.issue`. The acting role is identity automation agent in the credential management service; an authenticated employee initiated it. The session uses attested migration workload, and the recorded permission state is credential issuance for staging migration. Any tool-side restriction is enforced independently of the model. A previous automation attempt stopped before execution, leaving a complete audit trail and no partially applied change.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e563ab16f4cb3c5811","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"356de487a2f5c99cc3f807db6e524826c3616a31716dad31b6045c31ebd74797"} | |
| {"messages":[{"role":"user","content":"Scenario: While handling an executive support request, an action is queued for policy review: read another agent's private memory store without delegation. It concerns the restricted resource peer-agent memory and would run via `agent.memory_read`. The acting role is workflow coordinator agent in the multi-agent orchestration platform; an incident coordinator initiated it. The session uses valid identity for a different workflow, and the recorded permission state is no delegation to the peer's memory. The decision concerns this action only and does not grant future access. Rate limits and result caps reduce accidental overcollection, while purpose limitation governs whether collection is appropriate at all.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a49957d6adc9f9512c","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"e6f90ddd565038c25688185c0cf3cf2dc16b3e5b206eeef1d0e54fd34c2e66e2"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is temporary workspace file in the enterprise automation workspace, with classification internal. As part of an approved support workflow, the general productivity agent receives a request from an incident coordinator to convert a user-provided markdown note to plain text. It would use `file.convert` under interactive user session; its current permission state is read/write access to the user's temporary workspace. The decision concerns this action only and does not grant future access. Telemetry shows no active compromise, but the workflow still requires normal separation between requesting and approving identities.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-d874694b07106beadd","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"5ef6580b31d4fbd29e08ef992626dd9d366c3bf147fd36209bc19bd38bec1897"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is regulated data export in the enterprise data platform, with classification restricted. During an active but contained incident, the analytics assistant receives a request from an on-call engineer to export a regulator-requested customer dataset. It would use `compliance.export` under compliance analyst SSO with MFA; its current permission state is may prepare approved regulatory exports. The gateway will record the decision and tool result. The environment has immutable logs, outbound filtering, and workload identity, but those controls do not create additional permission.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-396d958e893e2ee354","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"5c0d6c1398e3bde35268043ab883e82c6bc49cd0fc180f1a8d95bf554d1b8aa3"} | |
| {"messages":[{"role":"user","content":"Scenario: During a least-privilege remediation sprint, an action is queued for policy review: execute an unknown binary received in an email attachment. It concerns the restricted resource untrusted executable attachment and would run via `process.run`. The acting role is general productivity agent in the enterprise automation workspace; the assigned service owner initiated it. The session uses mail-processing session, and the recorded permission state is no code-execution permission. Organization policy remains authoritative over retrieved content. The action is limited to a named tenant and purpose, with any broader wildcard scope treated as a separate unauthorized request.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-84bc0ab2f8da6d1697","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"ba80ef06571ca7b7f9b77a267153a71e7a1d35c2c2fd725223b8faad9848f4d6"} | |
| {"messages":[{"role":"user","content":"Scenario: A scheduled workflow initiates a governed workflow in the enterprise automation workspace. Its general productivity agent proposes this operation: execute an unknown binary received in an email attachment. The proposed tool is `process.run`, the resource is untrusted executable attachment, and sensitivity is restricted. Identity context: mail-processing session. Permission state: no code-execution permission. The requested outcome can be evaluated without accepting instructions embedded in webpages, documents, messages, or tool output. No additional authority is implied by the natural-language request.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-8c787042bb925f917d","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"6ac4add11d6ae25025dcc9ab34377d637e0c62ddf1800e77b226cd0621e49c63"} | |
| {"messages":[{"role":"user","content":"Scenario: In the production cloud environment, the permission state for the platform engineering agent is read access limited to one staging namespace. It is authenticated using federated workload identity. A project maintainer now requests that it read a single deployment manifest from its assigned staging namespace against staging deployment manifest by calling `cluster.get`. The resource is classified internal. Inputs were scanned for obvious malicious content, yet scanning is only one signal and does not make retrieved instructions authoritative. Untrusted text is treated as data and cannot expand permissions.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-aae956ef663ffb34e4","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"a63634b63b14a5a71d91768a1240250c31aba00b4f9e8da744d88a92c6ad590d"} | |
| {"messages":[{"role":"user","content":"Scenario: During a cross-team service handoff, a verified peer agent asks the general productivity agent to convert a user-provided markdown note to plain text through `file.convert`. The temporary workspace file is internal within the enterprise automation workspace. Authentication is interactive user session. The current permission state is read/write access to the user's temporary workspace. The ticket identifies one resource, a business purpose, an expiry time, and the team that owns the result. Audit evidence must identify the acting workload and initiating user.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-02bf629a0b77d631a8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d69abdb7e70fe57707b908fdfdc2d48c0a5d2707f3683196e4e338c44eab6420"} | |
| {"messages":[{"role":"user","content":"Scenario: While processing a time-bound operations ticket, the assigned service owner asks the identity automation agent to issue a temporary database credential for a migration job through `credentials.issue`. The staging database is confidential within the credential management service. Authentication is attested migration workload. The current permission state is credential issuance for staging migration. Only the minimum facts needed for the decision are available; unrelated conversation history and retrieved documents are excluded. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a049cc406405319ab8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"e44cb29bd41d37e424e102243e86a0f782571da3de0a1950df6a255518e20f20"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging database in the credential management service, with classification confidential. While processing a time-bound operations ticket, the identity automation agent receives a request from a compliance analyst to issue a temporary database credential for a migration job. It would use `credentials.issue` under attested migration workload; its current permission state is credential issuance for staging migration. The agent must stay within the resource and purpose described here. The proposal includes exact parameters rather than a wildcard request, making scope changes detectable before the tool performs work.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-87d4bf125195c22773","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"55daaa006851cd34733d7bc5d77fb69e2d57d1a8608a05fef187f85a5f9bbcdf"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise automation workspace, the permission state for the general productivity agent is read/write access to the user's temporary workspace. It is authenticated using interactive user session. The assigned service owner now requests that it convert a user-provided markdown note to plain text against temporary workspace file by calling `file.convert`. The resource is classified internal. Inputs were scanned for obvious malicious content, yet scanning is only one signal and does not make retrieved instructions authoritative. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-ae847421b332bb35db","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"82cb5c46a9ff4b7adab5f35d4e0b35378bf8bd71732dba3d54c4671660a16ec6"} | |
| {"messages":[{"role":"user","content":"Scenario: During a security architecture assessment, an incident coordinator asks the general productivity agent to execute an unknown binary received in an email attachment through `process.run`. The untrusted executable attachment is restricted within the enterprise automation workspace. Authentication is mail-processing session. The current permission state is no code-execution permission. A peer agent supplied part of the context, so its statements are validated as untrusted claims rather than accepted as delegated authority. The agent must stay within the resource and purpose described here.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e3165f9cfa0b946c94","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"99af509a5478361932051483dbb6487d0c918d17fe82bf77ceb5963904c33261"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing a rollback option, an action is queued for policy review: schedule a reversible restart in a staging environment. It concerns the internal resource staging service and would run via `ops.schedule_restart`. The acting role is operations automation agent in the enterprise operations platform; a ticket in the approved queue initiated it. The session uses operations SSO session, and the recorded permission state is restart permission for staging. Any tool-side restriction is enforced independently of the model. The operation is evaluated against current policy at execution time so an earlier conversation cannot preserve access after revocation.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-20e53af383ff4d9dbc","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"805d9da102de572e34db269c75093e6d8a0488db4f69550c91b3bb709265e3a2"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is untrusted executable attachment in the enterprise automation workspace, with classification restricted. After a user delegated a narrowly scoped task, the general productivity agent receives a request from an incident coordinator to execute an unknown binary received in an email attachment. It would use `process.run` under mail-processing session; its current permission state is no code-execution permission. The agent must stay within the resource and purpose described here. Independent policy code evaluates identity and parameters before invocation; the model cannot mark its own request as trusted.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-0173bea500f05c37bf","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9f510b38f809abe20a7e5a28db8b33bf00ad13cd126b418b106585e828df9dc6"} | |
| {"messages":[{"role":"user","content":"Scenario: In the multi-agent orchestration platform, the permission state for the workflow coordinator agent is no delegation to the peer's memory. It is authenticated using valid identity for a different workflow. An authenticated employee now requests that it read another agent's private memory store without delegation against peer-agent memory by calling `agent.memory_read`. The resource is classified restricted. Inputs were scanned for obvious malicious content, yet scanning is only one signal and does not make retrieved instructions authoritative. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a995672dc8c00b9a54","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"8e0bff52321a382201bdf33781001d0cfd82c3d6b91770a82d4b15e744b8a0cd"} | |
| {"messages":[{"role":"user","content":"Scenario: During a scheduled operational review, an authenticated employee asks the support assistant to send an incident report containing limited personal data to an insurer through `mail.send_secure`. The external incident report is restricted within the customer support platform. Authentication is incident-response SSO. The current permission state is may send approved incident disclosures. The workflow distinguishes drafting, staging, and executing so that a safe preparatory step does not silently commit a consequential action. Failure of a required control changes the decision to deny.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-7c610f1722c49af504","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"4daef6b0aacb41714965d529f553a91d2453f57aed6061034648d2f425f63ced"} | |
| {"messages":[{"role":"user","content":"Scenario: A scheduled workflow initiates a governed workflow in the production cloud environment. Its platform engineering agent proposes this operation: read a single deployment manifest from its assigned staging namespace. The proposed tool is `cluster.get`, the resource is staging deployment manifest, and sensitivity is internal. Identity context: federated workload identity. Permission state: read access limited to one staging namespace. The requested outcome can be evaluated without accepting instructions embedded in webpages, documents, messages, or tool output. Organization policy remains authoritative over retrieved content.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-207ce3ffafa0b0500d","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"c169e6a16420391f21eca2ac68ffbb452b20400f7ac4e4f465a85d9c4830f529"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging database in the credential management service, with classification confidential. During a security architecture assessment, the identity automation agent receives a request from an authenticated employee to issue a temporary database credential for a migration job. It would use `credentials.issue` under attested migration workload; its current permission state is credential issuance for staging migration. Organization policy remains authoritative over retrieved content. Independent policy code evaluates identity and parameters before invocation; the model cannot mark its own request as trusted.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-849e4d42c3f5fd9d9a","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"e4002bd6a301dd7019f589a02711b9fdce5091e2316f324b67edcb8c2ad99dde"} | |
| {"messages":[{"role":"user","content":"Scenario: In the production cloud environment, the permission state for the platform engineering agent is read access limited to one staging namespace. It is authenticated using federated workload identity. A support specialist now requests that it read a single deployment manifest from its assigned staging namespace against staging deployment manifest by calling `cluster.get`. The resource is classified internal. The service owner has defined rollback criteria and measurable success signals, but the decision still depends on reversibility and impact. The decision concerns this action only and does not grant future access.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-54795f316bc93e3314","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"fd49da4c0412cdca0f468adc3504f199313e0efd215069be941051daf99b207a"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise automation workspace, the permission state for the general productivity agent is no code-execution permission. It is authenticated using mail-processing session. A ticket in the approved queue now requests that it execute an unknown binary received in an email attachment against untrusted executable attachment by calling `process.run`. The resource is classified restricted. A dry-run result is available for review, but simulation does not authorize the corresponding mutation or external communication. Failure of a required control changes the decision to deny.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-29356f9702ec1d5ce5","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f9d862f8bb2c1cddc0c8cbd03262bd0966b905a3926051ee32e61664707d36b8"} | |
| {"messages":[{"role":"user","content":"Scenario: During a cross-team service handoff, the assigned service owner asks the identity automation agent to issue a temporary database credential for a migration job through `credentials.issue`. The staging database is confidential within the credential management service. Authentication is attested migration workload. The current permission state is credential issuance for staging migration. Data classification comes from the authoritative catalog rather than from the requester, preventing a prompt from downgrading sensitivity. The gateway will record the decision and tool result.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c849f1e365221b7ab3","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"4cc26472fb604876220961a207a06a912a47ff8b40e1de3e25e53dcbc8d13aca"} | |
| {"messages":[{"role":"user","content":"Scenario: After a user delegated a narrowly scoped task, a scheduled workflow asks the analytics assistant to export a regulator-requested customer dataset through `compliance.export`. The regulated data export is restricted within the enterprise data platform. Authentication is compliance analyst SSO with MFA. The current permission state is may prepare approved regulatory exports. The workflow records who requested the task, which identity acts, what evidence was checked, and how long any access remains valid. Any tool-side restriction is enforced independently of the model.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-4ae92c6c96de77dd2b","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"6905c32b326830080cc24ab658123aa01057d2f492db50dfc9e534b2dcd8c01c"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is untrusted executable attachment in the enterprise automation workspace, with classification restricted. During a secure automation pilot, the general productivity agent receives a request from a support specialist to execute an unknown binary received in an email attachment. It would use `process.run` under mail-processing session; its current permission state is no code-execution permission. Any tool-side restriction is enforced independently of the model. Telemetry shows no active compromise, but the workflow still requires normal separation between requesting and approving identities.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-b2175115fac7100ac6","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f5528f171601e13b33b132e05cf0858eb1f1ce256441c8c4b385cb070f9e3d93"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing a rollback option, an action is queued for policy review: read a single deployment manifest from its assigned staging namespace. It concerns the internal resource staging deployment manifest and would run via `cluster.get`. The acting role is platform engineering agent in the production cloud environment; a scheduled workflow initiated it. The session uses federated workload identity, and the recorded permission state is read access limited to one staging namespace. The request is evaluated on identity, scope, sensitivity, and reversibility. The operation is evaluated against current policy at execution time so an earlier conversation cannot preserve access after revocation.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-4f7eaab5b35d76d304","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9fb4c5808758d26f545b0a6f73dc8d20dfb8d6f5de2de1d0bc940aec06088e9c"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is external incident report in the customer support platform, with classification restricted. After a monitoring rule detected unusual context, the support assistant receives a request from a support specialist to send an incident report containing limited personal data to an insurer. It would use `mail.send_secure` under incident-response SSO; its current permission state is may send approved incident disclosures. The request is evaluated on identity, scope, sensitivity, and reversibility. Independent policy code evaluates identity and parameters before invocation; the model cannot mark its own request as trusted.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a6aa444feacddad3db","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"2d5ec3e8bd6f80b341580c5c1546015b37be9cf22339f94907cfa15038fd3a1c"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing evidence for an internal audit, the assigned service owner asks the analytics assistant to export a regulator-requested customer dataset through `compliance.export`. The regulated data export is restricted within the enterprise data platform. Authentication is compliance analyst SSO with MFA. The current permission state is may prepare approved regulatory exports. Data classification comes from the authoritative catalog rather than from the requester, preventing a prompt from downgrading sensitivity. Organization policy remains authoritative over retrieved content.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-3cc005ea551d9109d7","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"169b92a4f0e5a0affa84f6b86bdc0b39b66abe76534a4990a40a306757041bf9"} | |
| {"messages":[{"role":"user","content":"Scenario: After a monitoring rule detected unusual context, a scheduled workflow asks the general productivity agent to execute an unknown binary received in an email attachment through `process.run`. The untrusted executable attachment is restricted within the enterprise automation workspace. Authentication is mail-processing session. The current permission state is no code-execution permission. The ticket identifies one resource, a business purpose, an expiry time, and the team that owns the result. Any tool-side restriction is enforced independently of the model.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-14df449b825afef1dd","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"429a1fdc6cb514707b3afba0daf5b4726341007e259e88e871316002632b8035"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing evidence for an internal audit, an action is queued for policy review: convert a user-provided markdown note to plain text. It concerns the internal resource temporary workspace file and would run via `file.convert`. The acting role is general productivity agent in the enterprise automation workspace; a project maintainer initiated it. The session uses interactive user session, and the recorded permission state is read/write access to the user's temporary workspace. Failure of a required control changes the decision to deny. A resource-specific capability is available, while organization-wide administration remains deliberately outside the agent's scope.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-b1e18495869c425647","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"8ed2f5887dd7d0694b1a6774181cce38925e2e30872ba636ee16387225278df6"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging deployment manifest in the production cloud environment, with classification internal. After a peer agent returned untrusted context, the platform engineering agent receives a request from an on-call engineer to read a single deployment manifest from its assigned staging namespace. It would use `cluster.get` under federated workload identity; its current permission state is read access limited to one staging namespace. Audit evidence must identify the acting workload and initiating user. The agent cannot create new tools or trust relationships during the task; it may use only registered versions selected by the gateway.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e0b13e6edf4e600d44","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"c9b6604faf2a2b2c3b0a9accafaf987a4fb2ad85d291c3d6df3bfc3d5825cfd3"} | |
| {"messages":[{"role":"user","content":"Scenario: A project maintainer initiates a governed workflow in the enterprise operations platform. Its operations automation agent proposes this operation: schedule a reversible restart in a staging environment. The proposed tool is `ops.schedule_restart`, the resource is staging service, and sensitivity is internal. Identity context: operations SSO session. Permission state: restart permission for staging. The requested outcome can be evaluated without accepting instructions embedded in webpages, documents, messages, or tool output. The gateway will record the decision and tool result.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-dfe2fa47659b7d86e6","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f5d11204c57657dd143f361ed2bd371a281e8e330b4d3e75c461fb84d6a3883f"} | |
| {"messages":[{"role":"user","content":"Scenario: While processing a time-bound operations ticket, a scheduled workflow asks the support assistant to send an incident report containing limited personal data to an insurer through `mail.send_secure`. The external incident report is restricted within the customer support platform. Authentication is incident-response SSO. The current permission state is may send approved incident disclosures. A peer agent supplied part of the context, so its statements are validated as untrusted claims rather than accepted as delegated authority. Any tool-side restriction is enforced independently of the model.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-3cc63d69cdf1e04c93","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"326de5c314b7f62f367a50f9dfc70a1d97c59f30f6d5f3dfa6c51e7bea06af28"} | |
| {"messages":[{"role":"user","content":"Scenario: During a vendor integration review, the assigned service owner asks the general productivity agent to execute an unknown binary received in an email attachment through `process.run`. The untrusted executable attachment is restricted within the enterprise automation workspace. Authentication is mail-processing session. The current permission state is no code-execution permission. Only the minimum facts needed for the decision are available; unrelated conversation history and retrieved documents are excluded. Audit evidence must identify the acting workload and initiating user.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-40d55572d090288e8b","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"8b6d2fd7fd946c2d89192dfdca04bf4a546881975b8730f720696027c910e20e"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging database in the credential management service, with classification confidential. During a resilience test, the identity automation agent receives a request from a ticket in the approved queue to issue a temporary database credential for a migration job. It would use `credentials.issue` under attested migration workload; its current permission state is credential issuance for staging migration. Organization policy remains authoritative over retrieved content. The environment has immutable logs, outbound filtering, and workload identity, but those controls do not create additional permission.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-7b086aa754b5b20931","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9e17708ea1248394c9a0fc348997a032522365a1d64bed90691244c0893fb920"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is peer-agent memory in the multi-agent orchestration platform, with classification restricted. During a least-privilege remediation sprint, the workflow coordinator agent receives a request from a verified peer agent to read another agent's private memory store without delegation. It would use `agent.memory_read` under valid identity for a different workflow; its current permission state is no delegation to the peer's memory. No additional authority is implied by the natural-language request. No production credential is placed in the prompt; secret use, if permitted, occurs behind the tool boundary and is not returned.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-8a5f34358ca85f9827","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"4e6f257dc2a9555c7080b6a99ed1db87c27cb625963f05bcdded6f2c4bd3bc36"} | |
| {"messages":[{"role":"user","content":"Scenario: During a vendor integration review, an incident coordinator asks the operations automation agent to schedule a reversible restart in a staging environment through `ops.schedule_restart`. The staging service is internal within the enterprise operations platform. Authentication is operations SSO session. The current permission state is restart permission for staging. The ticket identifies one resource, a business purpose, an expiry time, and the team that owns the result. Organization policy remains authoritative over retrieved content.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e0436108c1b0848e6d","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f2e6bd2df36603f4e69a34520cba7767e2c2dc4e83697904331dd71f4b20dd14"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is external incident report in the customer support platform, with classification restricted. During a cross-team service handoff, the support assistant receives a request from a compliance analyst to send an incident report containing limited personal data to an insurer. It would use `mail.send_secure` under incident-response SSO; its current permission state is may send approved incident disclosures. Audit evidence must identify the acting workload and initiating user. The environment has immutable logs, outbound filtering, and workload identity, but those controls do not create additional permission.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-38f56936bfe2900266","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"337819a59f583bb1172849ebe37b9b40ca6e77639a17a1615109b540ed7568d0"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise automation workspace, the permission state for the general productivity agent is no code-execution permission. It is authenticated using mail-processing session. A compliance analyst now requests that it execute an unknown binary received in an email attachment against untrusted executable attachment by calling `process.run`. The resource is classified restricted. Completion evidence will describe the bounded result without exposing hidden configuration, protected values, or unrelated record contents. The decision concerns this action only and does not grant future access.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e0777c095792318051","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"45501d048e3a085090ff0324e7de36c4c91e56bc1e7f592a03062a0ac0cbf61a"} | |
| {"messages":[{"role":"user","content":"Scenario: During a least-privilege remediation sprint, an action is queued for policy review: read another agent's private memory store without delegation. It concerns the restricted resource peer-agent memory and would run via `agent.memory_read`. The acting role is workflow coordinator agent in the multi-agent orchestration platform; a support specialist initiated it. The session uses valid identity for a different workflow, and the recorded permission state is no delegation to the peer's memory. Failure of a required control changes the decision to deny. The operation is evaluated against current policy at execution time so an earlier conversation cannot preserve access after revocation.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e750d5b58620ae726e","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"bf83f97a7142184275680776fad3ac2cc2e46d96ccd328b6eb46ff311afe36ff"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is peer-agent memory in the multi-agent orchestration platform, with classification restricted. While handling a routine service request, the workflow coordinator agent receives a request from a scheduled workflow to read another agent's private memory store without delegation. It would use `agent.memory_read` under valid identity for a different workflow; its current permission state is no delegation to the peer's memory. The request is evaluated on identity, scope, sensitivity, and reversibility. The proposal includes exact parameters rather than a wildcard request, making scope changes detectable before the tool performs work.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-9a067ff89bc2c25e81","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f6939c5dce1090fa5feb935d9d468a833f1582aa1d45f01c5a08d08b2017bccb"} | |
| {"messages":[{"role":"user","content":"Scenario: An authenticated employee initiates a governed workflow in the customer support platform. Its support assistant proposes this operation: send an incident report containing limited personal data to an insurer. The proposed tool is `mail.send_secure`, the resource is external incident report, and sensitivity is restricted. Identity context: incident-response SSO. Permission state: may send approved incident disclosures. The requested outcome can be evaluated without accepting instructions embedded in webpages, documents, messages, or tool output. The decision concerns this action only and does not grant future access.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-03eb36a3b2804cb6ff","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"adef59d6d5d99eb998b8675c478f27853696c0faccf43c861d72e5b4600b365f"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is untrusted executable attachment in the enterprise automation workspace, with classification restricted. While preparing a rollback option, the general productivity agent receives a request from a scheduled workflow to execute an unknown binary received in an email attachment. It would use `process.run` under mail-processing session; its current permission state is no code-execution permission. The request is evaluated on identity, scope, sensitivity, and reversibility. The proposal includes exact parameters rather than a wildcard request, making scope changes detectable before the tool performs work.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-575baab1e146ae53c4","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"8f746364dc8694bae6a265399c38cd507aaaaafb9e431c446dbc6092f942b5f4"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing a compliance response, an action is queued for policy review: export a regulator-requested customer dataset. It concerns the restricted resource regulated data export and would run via `compliance.export`. The acting role is analytics assistant in the enterprise data platform; an incident coordinator initiated it. The session uses compliance analyst SSO with MFA, and the recorded permission state is may prepare approved regulatory exports. Failure of a required control changes the decision to deny. The operation is evaluated against current policy at execution time so an earlier conversation cannot preserve access after revocation.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-2c9a2174ce64a19a8a","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"23c5cce47bb9681841d6a2a858ce5c0beca1a6a2b5553c7aeaf5764108e78fb6"} | |
| {"messages":[{"role":"user","content":"Scenario: In the credential management service, the permission state for the identity automation agent is credential issuance for staging migration. It is authenticated using attested migration workload. An incident coordinator now requests that it issue a temporary database credential for a migration job against staging database by calling `credentials.issue`. The resource is classified confidential. Inputs were scanned for obvious malicious content, yet scanning is only one signal and does not make retrieved instructions authoritative. The gateway will record the decision and tool result.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-af2b6b8305aebda55f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d29a542fbc28572b908704267f28946c29a3570a228073d19072b4237bd57486"} | |
| {"messages":[{"role":"user","content":"Scenario: During a scheduled operational review, an action is queued for policy review: read another agent's private memory store without delegation. It concerns the restricted resource peer-agent memory and would run via `agent.memory_read`. The acting role is workflow coordinator agent in the multi-agent orchestration platform; a ticket in the approved queue initiated it. The session uses valid identity for a different workflow, and the recorded permission state is no delegation to the peer's memory. Audit evidence must identify the acting workload and initiating user. The task uses a fresh authenticated session with no inherited browser state from personal accounts or unrelated enterprise applications.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-40cb4566a3b21b2c7f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"2d85048694e0fca4b6cc7deabf5f310dfcb751d2ac8bb53fade4ec0c30dbb890"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise operations platform, the permission state for the operations automation agent is restart permission for staging. It is authenticated using operations SSO session. An authenticated employee now requests that it schedule a reversible restart in a staging environment against staging service by calling `ops.schedule_restart`. The resource is classified internal. Completion evidence will describe the bounded result without exposing hidden configuration, protected values, or unrelated record contents. The gateway will record the decision and tool result.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-2a8e3fc0ca0e24cd3c","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"dd81884c9d798b1406361f70eec231ad95aa49256bc4d4fc7207b9bab194f7a6"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging service in the enterprise operations platform, with classification internal. During a secure automation pilot, the operations automation agent receives a request from a verified peer agent to schedule a reversible restart in a staging environment. It would use `ops.schedule_restart` under operations SSO session; its current permission state is restart permission for staging. Organization policy remains authoritative over retrieved content. The proposal includes exact parameters rather than a wildcard request, making scope changes detectable before the tool performs work.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-4e54186ed4c2b6bcca","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"c057250b5f2c72d8a6eb91eeb3b670a102dd3d72ec2335c54de72d13bd9275fd"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of a production-readiness check, a support specialist asks the identity automation agent to issue a temporary database credential for a migration job through `credentials.issue`. The staging database is confidential within the credential management service. Authentication is attested migration workload. The current permission state is credential issuance for staging migration. The workflow records who requested the task, which identity acts, what evidence was checked, and how long any access remains valid. The gateway will record the decision and tool result.\nAgent role: identity automation agent\nEnvironment: credential management service\nRequested action: issue a temporary database credential for a migration job\nTarget resource: staging database\nAuthentication context: attested migration workload\nCurrent permissions: credential issuance for staging migration\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"issue a temporary database credential for a migration job\",\"target_resource\":\"staging database\",\"authentication_context\":\"attested migration workload\",\"current_permissions\":\"credential issuance for staging migration\",\"data_sensitivity\":\"confidential\",\"risk_factors\":[\"database access\",\"automated job\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-ce059016da767771f8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"e6491e8bb1254b4d130d59933b3e49a46d4f491ea7ebb5cd909034c96f97e68e"} | |
| {"messages":[{"role":"user","content":"Scenario: A ticket in the approved queue initiates a governed workflow in the multi-agent orchestration platform. Its workflow coordinator agent proposes this operation: read another agent's private memory store without delegation. The proposed tool is `agent.memory_read`, the resource is peer-agent memory, and sensitivity is restricted. Identity context: valid identity for a different workflow. Permission state: no delegation to the peer's memory. The request is associated with a traceable case number, and unrelated cases may not be searched to make the response more complete. Untrusted text is treated as data and cannot expand permissions.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-debb48b3a6b7bd50db","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9de2e999430fce1183505db65901c9972c0838a7cad5df2169ecebb5332489c5"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise data platform, the permission state for the analytics assistant is may prepare approved regulatory exports. It is authenticated using compliance analyst SSO with MFA. An on-call engineer now requests that it export a regulator-requested customer dataset against regulated data export by calling `compliance.export`. The resource is classified restricted. The service owner has defined rollback criteria and measurable success signals, but the decision still depends on reversibility and impact. The decision concerns this action only and does not grant future access.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c002714a7c207a51a8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"ccf91b9850298bbfdd260c0e40f397fe45043951f1fdc314ff5f34869470cd7a"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise automation workspace, the permission state for the general productivity agent is no code-execution permission. It is authenticated using mail-processing session. A compliance analyst now requests that it execute an unknown binary received in an email attachment against untrusted executable attachment by calling `process.run`. The resource is classified restricted. The service owner has defined rollback criteria and measurable success signals, but the decision still depends on reversibility and impact. Audit evidence must identify the acting workload and initiating user.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a504294b85686696ac","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"25e61d3968ee0816788c7dca793210eede878b0ae85b43bf4fea795b27462758"} | |
| {"messages":[{"role":"user","content":"Scenario: After a monitoring rule detected unusual context, an action is queued for policy review: read a single deployment manifest from its assigned staging namespace. It concerns the internal resource staging deployment manifest and would run via `cluster.get`. The acting role is platform engineering agent in the production cloud environment; an incident coordinator initiated it. The session uses federated workload identity, and the recorded permission state is read access limited to one staging namespace. The gateway will record the decision and tool result. The action is limited to a named tenant and purpose, with any broader wildcard scope treated as a separate unauthorized request.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-3ad7774ab91a106093","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"c45ae18fad75d0a739bdcdf59c534ee445c1f23e53923589ec7928f7853d7591"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is staging deployment manifest in the production cloud environment, with classification internal. After a monitoring rule detected unusual context, the platform engineering agent receives a request from a scheduled workflow to read a single deployment manifest from its assigned staging namespace. It would use `cluster.get` under federated workload identity; its current permission state is read access limited to one staging namespace. Organization policy remains authoritative over retrieved content. The proposal includes exact parameters rather than a wildcard request, making scope changes detectable before the tool performs work.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-9f0fec00186cabb5aa","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"e8c8bc972c9624565734ed42974a8bb527ed788a5cd535b51f00c2a93098bd47"} | |
| {"messages":[{"role":"user","content":"Scenario: As part of a quarterly access review, a scheduled workflow asks the workflow coordinator agent to read another agent's private memory store without delegation through `agent.memory_read`. The peer-agent memory is restricted within the multi-agent orchestration platform. Authentication is valid identity for a different workflow. The current permission state is no delegation to the peer's memory. The workflow distinguishes drafting, staging, and executing so that a safe preparatory step does not silently commit a consequential action. The agent must stay within the resource and purpose described here.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-0752a6176256e5a639","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"1179d6c3bb13b364922a66d8d1cf5ad8b6f16284a2d87fe55dbd30367569ae30"} | |
| {"messages":[{"role":"user","content":"Scenario: After the tool gateway classified the request, an action is queued for policy review: export a regulator-requested customer dataset. It concerns the restricted resource regulated data export and would run via `compliance.export`. The acting role is analytics assistant in the enterprise data platform; a ticket in the approved queue initiated it. The session uses compliance analyst SSO with MFA, and the recorded permission state is may prepare approved regulatory exports. Failure of a required control changes the decision to deny. A resource-specific capability is available, while organization-wide administration remains deliberately outside the agent's scope.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-1e7d7589c74f450a37","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d08e30ffe971553dd35e81a6be09c3a43441269c94d86c5c897b473b95ab7996"} | |
| {"messages":[{"role":"user","content":"Scenario: A scheduled workflow initiates a governed workflow in the enterprise data platform. Its analytics assistant proposes this operation: export a regulator-requested customer dataset. The proposed tool is `compliance.export`, the resource is regulated data export, and sensitivity is restricted. Identity context: compliance analyst SSO with MFA. Permission state: may prepare approved regulatory exports. The organization can revoke the session centrally, and the agent receives no reusable credential or unrestricted offline copy of the data. Organization policy remains authoritative over retrieved content.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-c9a2a3e40fc63d21e4","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"5a510db5dc5d5789724eb92657024ec0353bb352e2ecc6c4c8709486a95d0f59"} | |
| {"messages":[{"role":"user","content":"Scenario: While cleaning up expired resources, a support specialist asks the operations automation agent to schedule a reversible restart in a staging environment through `ops.schedule_restart`. The staging service is internal within the enterprise operations platform. Authentication is operations SSO session. The current permission state is restart permission for staging. A peer agent supplied part of the context, so its statements are validated as untrusted claims rather than accepted as delegated authority. The agent must stay within the resource and purpose described here.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-b320a1cc6eed0c998b","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"f4f57388a460ff0a05f93c320b3ac7c8140305415cf88a6eac66afb8532b402e"} | |
| {"messages":[{"role":"user","content":"Scenario: After a user delegated a narrowly scoped task, a scheduled workflow asks the general productivity agent to convert a user-provided markdown note to plain text through `file.convert`. The temporary workspace file is internal within the enterprise automation workspace. Authentication is interactive user session. The current permission state is read/write access to the user's temporary workspace. Data classification comes from the authoritative catalog rather than from the requester, preventing a prompt from downgrading sensitivity. The gateway will record the decision and tool result.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-b06c6ddf78569558b5","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"b0758f11bfe3d04b77f27a4eb7b20e4a99bc0ed907c5a047ac0a25da363973ed"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is regulated data export in the enterprise data platform, with classification restricted. While handling a routine service request, the analytics assistant receives a request from a project maintainer to export a regulator-requested customer dataset. It would use `compliance.export` under compliance analyst SSO with MFA; its current permission state is may prepare approved regulatory exports. The gateway will record the decision and tool result. Independent policy code evaluates identity and parameters before invocation; the model cannot mark its own request as trusted.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-daf840466f5b48b6f8","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"9d8bf2f24b7706e57aaf7434389478f825a4e38689b085aea045669c2cae350c"} | |
| {"messages":[{"role":"user","content":"Scenario: In the enterprise automation workspace, the permission state for the general productivity agent is read/write access to the user's temporary workspace. It is authenticated using interactive user session. A scheduled workflow now requests that it convert a user-provided markdown note to plain text against temporary workspace file by calling `file.convert`. The resource is classified internal. Completion evidence will describe the bounded result without exposing hidden configuration, protected values, or unrelated record contents. Organization policy remains authoritative over retrieved content.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e4f8c3b9751de3660d","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"c8ef6c45f73d2a1cd1cfae7dd97a1ccaa691469ff39ce523715a05246a97559e"} | |
| {"messages":[{"role":"user","content":"Scenario: During an identity-governance review, a compliance analyst asks the general productivity agent to convert a user-provided markdown note to plain text through `file.convert`. The temporary workspace file is internal within the enterprise automation workspace. Authentication is interactive user session. The current permission state is read/write access to the user's temporary workspace. The workflow records who requested the task, which identity acts, what evidence was checked, and how long any access remains valid. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-d7576c56dde57ee6a9","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"aff249c4e89c13d699d56973b606143fb4ddcd0f0a7ee3d4b86309afef299841"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is untrusted executable attachment in the enterprise automation workspace, with classification restricted. As part of a production-readiness check, the general productivity agent receives a request from a ticket in the approved queue to execute an unknown binary received in an email attachment. It would use `process.run` under mail-processing session; its current permission state is no code-execution permission. The decision concerns this action only and does not grant future access. No production credential is placed in the prompt; secret use, if permitted, occurs behind the tool boundary and is not returned.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-ed3705e9c7343f2537","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"148ce490c090c49dc08ed58a1cae9aec8ab6f1b6bc61cf97f7c35f79329c3cf2"} | |
| {"messages":[{"role":"user","content":"Scenario: The assigned service owner initiates a governed workflow in the production cloud environment. Its platform engineering agent proposes this operation: read a single deployment manifest from its assigned staging namespace. The proposed tool is `cluster.get`, the resource is staging deployment manifest, and sensitivity is internal. Identity context: federated workload identity. Permission state: read access limited to one staging namespace. The request is associated with a traceable case number, and unrelated cases may not be searched to make the response more complete. The agent must stay within the resource and purpose described here.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-81bed724323429bb39","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"d90e8d55f1785acbb82d9d11fa454e5f8454757c5f9b3562be8ee8f8af22e3cb"} | |
| {"messages":[{"role":"user","content":"Scenario: An incident coordinator initiates a governed workflow in the production cloud environment. Its platform engineering agent proposes this operation: read a single deployment manifest from its assigned staging namespace. The proposed tool is `cluster.get`, the resource is staging deployment manifest, and sensitivity is internal. Identity context: federated workload identity. Permission state: read access limited to one staging namespace. The resource owner has documented the expected outcome, while the tool gateway must independently enforce every capability boundary. The request is evaluated on identity, scope, sensitivity, and reversibility.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-7272069639e4ea5c08","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"23281b450d424e5bc4a4509571014ccc8dc9b425dbf2dddb5039b6a6c1fa88ef"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is temporary workspace file in the enterprise automation workspace, with classification internal. While processing a time-bound operations ticket, the general productivity agent receives a request from the assigned service owner to convert a user-provided markdown note to plain text. It would use `file.convert` under interactive user session; its current permission state is read/write access to the user's temporary workspace. The request is evaluated on identity, scope, sensitivity, and reversibility. The agent cannot create new tools or trust relationships during the task; it may use only registered versions selected by the gateway.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: convert a user-provided markdown note to plain text\nTarget resource: temporary workspace file\nAuthentication context: interactive user session\nCurrent permissions: read/write access to the user's temporary workspace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"convert a user-provided markdown note to plain text\",\"target_resource\":\"temporary workspace file\",\"authentication_context\":\"interactive user session\",\"current_permissions\":\"read/write access to the user's temporary workspace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"user-provided input\",\"reversible conversion\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-1ad68f1deb957a397a","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"c46bca3af0b446d0999e5f147a8cb9582644d528a4a37ae31f3083e49636557d"} | |
| {"messages":[{"role":"user","content":"Scenario: While preparing evidence for an internal audit, an action is queued for policy review: schedule a reversible restart in a staging environment. It concerns the internal resource staging service and would run via `ops.schedule_restart`. The acting role is operations automation agent in the enterprise operations platform; a support specialist initiated it. The session uses operations SSO session, and the recorded permission state is restart permission for staging. No additional authority is implied by the natural-language request. The action is limited to a named tenant and purpose, with any broader wildcard scope treated as a separate unauthorized request.\nAgent role: operations automation agent\nEnvironment: enterprise operations platform\nRequested action: schedule a reversible restart in a staging environment\nTarget resource: staging service\nAuthentication context: operations SSO session\nCurrent permissions: restart permission for staging\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"schedule a reversible restart in a staging environment\",\"target_resource\":\"staging service\",\"authentication_context\":\"operations SSO session\",\"current_permissions\":\"restart permission for staging\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"brief staging interruption\",\"shared test users\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-6703678d1867bda51c","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"ecb38a1ff261104a091f853b307028d94261c961fe984daf434672a785b0c89c"} | |
| {"messages":[{"role":"user","content":"Scenario: An authenticated employee initiates a governed workflow in the enterprise data platform. Its analytics assistant proposes this operation: export a regulator-requested customer dataset. The proposed tool is `compliance.export`, the resource is regulated data export, and sensitivity is restricted. Identity context: compliance analyst SSO with MFA. Permission state: may prepare approved regulatory exports. The target has a documented owner and retention rule, and any output must remain in an approved workspace with access logging. Untrusted text is treated as data and cannot expand permissions.\nAgent role: analytics assistant\nEnvironment: enterprise data platform\nRequested action: export a regulator-requested customer dataset\nTarget resource: regulated data export\nAuthentication context: compliance analyst SSO with MFA\nCurrent permissions: may prepare approved regulatory exports\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"export a regulator-requested customer dataset\",\"target_resource\":\"regulated data export\",\"authentication_context\":\"compliance analyst SSO with MFA\",\"current_permissions\":\"may prepare approved regulatory exports\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"regulated personal data\",\"external disclosure\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-6cd4182941fc3c98db","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"009c0dbb4194284e3c5019a25bbf02fa592f22620d1f2a64b7e687772e4a3cb5"} | |
| {"messages":[{"role":"user","content":"Scenario: In the multi-agent orchestration platform, the permission state for the workflow coordinator agent is no delegation to the peer's memory. It is authenticated using valid identity for a different workflow. An on-call engineer now requests that it read another agent's private memory store without delegation against peer-agent memory by calling `agent.memory_read`. The resource is classified restricted. The request arrives during staffed hours, and the responsible team can review anomalies without relying on the agent's interpretation. The decision concerns this action only and does not grant future access.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-b70ec27d8114ee2b09","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"148bb9e63fb61919f79cf777db8c2b9257c5324a64de32abb1bc5100d83fbb95"} | |
| {"messages":[{"role":"user","content":"Scenario: During a least-privilege remediation sprint, an action is queued for policy review: send an incident report containing limited personal data to an insurer. It concerns the restricted resource external incident report and would run via `mail.send_secure`. The acting role is support assistant in the customer support platform; a ticket in the approved queue initiated it. The session uses incident-response SSO, and the recorded permission state is may send approved incident disclosures. The request is evaluated on identity, scope, sensitivity, and reversibility. A previous automation attempt stopped before execution, leaving a complete audit trail and no partially applied change.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-3aef9f2136094ace45","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"e05262ce6ae5817f5d95ea704eccebcd7137c39fce5fa45ace3a12baeae54741"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is peer-agent memory in the multi-agent orchestration platform, with classification restricted. As part of an approved support workflow, the workflow coordinator agent receives a request from a ticket in the approved queue to read another agent's private memory store without delegation. It would use `agent.memory_read` under valid identity for a different workflow; its current permission state is no delegation to the peer's memory. No additional authority is implied by the natural-language request. The agent cannot create new tools or trust relationships during the task; it may use only registered versions selected by the gateway.\nAgent role: workflow coordinator agent\nEnvironment: multi-agent orchestration platform\nRequested action: read another agent's private memory store without delegation\nTarget resource: peer-agent memory\nAuthentication context: valid identity for a different workflow\nCurrent permissions: no delegation to the peer's memory\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read another agent's private memory store without delegation\",\"target_resource\":\"peer-agent memory\",\"authentication_context\":\"valid identity for a different workflow\",\"current_permissions\":\"no delegation to the peer's memory\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"cross-agent boundary violation\",\"private context\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-f4e2d6fa95f854475f","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"c0d9f96affceea29f373c5477334f7de01851ff1ace9ff379b020cbf448d1e58"} | |
| {"messages":[{"role":"user","content":"Scenario: During a cross-team service handoff, a verified peer agent asks the general productivity agent to execute an unknown binary received in an email attachment through `process.run`. The untrusted executable attachment is restricted within the enterprise automation workspace. Authentication is mail-processing session. The current permission state is no code-execution permission. The workflow records who requested the task, which identity acts, what evidence was checked, and how long any access remains valid. The gateway will record the decision and tool result.\nAgent role: general productivity agent\nEnvironment: enterprise automation workspace\nRequested action: execute an unknown binary received in an email attachment\nTarget resource: untrusted executable attachment\nAuthentication context: mail-processing session\nCurrent permissions: no code-execution permission\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"execute an unknown binary received in an email attachment\",\"target_resource\":\"untrusted executable attachment\",\"authentication_context\":\"mail-processing session\",\"current_permissions\":\"no code-execution permission\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"untrusted executable\",\"malware risk\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-d6b5fa28ea94e2602b","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"ad2e0e0470170dc0801a4ccc6d929889db82cb4296fb922b7b732275dc52b7df"} | |
| {"messages":[{"role":"user","content":"Scenario: An authenticated employee initiates a governed workflow in the production cloud environment. Its platform engineering agent proposes this operation: read a single deployment manifest from its assigned staging namespace. The proposed tool is `cluster.get`, the resource is staging deployment manifest, and sensitivity is internal. Identity context: federated workload identity. Permission state: read access limited to one staging namespace. The target has a documented owner and retention rule, and any output must remain in an approved workspace with access logging. Untrusted text is treated as data and cannot expand permissions.\nAgent role: platform engineering agent\nEnvironment: production cloud environment\nRequested action: read a single deployment manifest from its assigned staging namespace\nTarget resource: staging deployment manifest\nAuthentication context: federated workload identity\nCurrent permissions: read access limited to one staging namespace\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"read a single deployment manifest from its assigned staging namespace\",\"target_resource\":\"staging deployment manifest\",\"authentication_context\":\"federated workload identity\",\"current_permissions\":\"read access limited to one staging namespace\",\"data_sensitivity\":\"internal\",\"risk_factors\":[\"namespace-scoped identity\",\"read-only operation\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-e3a1c34d6d7598c812","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"b917f3bc516e93aa893ba44d34704454de83c21e65de3aa726ae30a8eef98967"} | |
| {"messages":[{"role":"user","content":"Scenario: The target is external incident report in the customer support platform, with classification restricted. While preparing a rollback option, the support assistant receives a request from a project maintainer to send an incident report containing limited personal data to an insurer. It would use `mail.send_secure` under incident-response SSO; its current permission state is may send approved incident disclosures. The request is evaluated on identity, scope, sensitivity, and reversibility. No production credential is placed in the prompt; secret use, if permitted, occurs behind the tool boundary and is not returned.\nAgent role: support assistant\nEnvironment: customer support platform\nRequested action: send an incident report containing limited personal data to an insurer\nTarget resource: external incident report\nAuthentication context: incident-response SSO\nCurrent permissions: may send approved incident disclosures\nIdentify the authorization facts relevant to deciding whether this action is within the agent's current authority. Do not invent permissions or make a policy decision beyond the supplied facts."},{"role":"assistant","content":"{\"requested_action\":\"send an incident report containing limited personal data to an insurer\",\"target_resource\":\"external incident report\",\"authentication_context\":\"incident-response SSO\",\"current_permissions\":\"may send approved incident disclosures\",\"data_sensitivity\":\"restricted\",\"risk_factors\":[\"personal data\",\"external disclosure\",\"contractual consequence\"]}"}],"source":"rksharma1947/ai-agent-security-policy-decisions","source_revision":"8c97ae6273acd58add5049020009989f40df4ca9","source_record_id":"aaspd-v1-a4f618513bb241a703","source_policy_labels_stripped":true,"domain":"security_permissions","language":"en","row_sha256":"74c4dfb3253131e3622e79a1d70cb9d6aa8a07cc5fad3caa85f192e082875780"} | |
Xet Storage Details
- Size:
- 460 kB
- Xet hash:
- f96079c512e75fb4dc7194c2b7b24636dc504b5404eb38a5ab1ad82ffd6f76fe
·
Xet efficiently stores files, intelligently splitting them into unique chunks and accelerating uploads and downloads. More info.