Proving Least Privilege with Denial Tests
Least privilege is not proved by showing that approved work succeeds. It is proved by testing the nearby actions, resources, identities, and conditions that policy must deny.
authorization
Latest
Prompt Injection Is an Authorization Failure with Words Attached
After reading my post on AI firewalls, a friend asked for my take on prompt injection. Prompt injection becomes dangerous when untrusted content can steer a software principal into using authority that the content never possessed.