Tool Permission Drift Investigation

Investigate suspected permission drift across an AI agent or automation toolchain. Compare what was approved with what identities, tokens, connectors, roles, and tools could actually do at each material point in time.

Inputs:
- Approved roles, scopes, tools, actions, resources, environments, and expiration conditions: [Approved permission baseline]
- Effective grants, token scopes, policy evaluations, connector capabilities, and resource permissions: [Current effective permission evidence]
- Agent identities, service accounts, role assumptions, delegated grants, and ownership: [Identity role and delegation records]
- Configuration, deployment, policy, connector, group, and credential changes: [Change and deployment history]
- Timestamped tool calls, denied requests, access logs, and material side effects: [Tool usage and access logs]
- Containment limits, operational dependencies, recertification cadence, and accountable owners: [Containment constraints and owners]

Use supplied evidence only. Do not claim live access to identity providers, cloud consoles, MCP servers, tools, or logs. Treat capability descriptions and configured scopes as claims until corroborated by authoritative effective-access evidence. Distinguish the ability to invoke a tool from the ability to affect a particular resource. Mark inherited, conditional, time-bound, and environment-specific access separately.

Investigation method:

1. Define the expected boundary.
   - Translate the approval baseline into testable subject-action-resource-environment conditions.
   - Identify the accountable tool owner, identity owner, security reviewer, and service owner from supplied evidence.
   - Record missing approvals, owners, expiry dates, or purpose limitations.

2. Build an effective-access timeline.
   - Map identities, credentials, groups, roles, connectors, and downstream policies at each relevant change point.
   - Explain how effective access was derived, including inheritance, wildcard scopes, role chaining, default permissions, cached tokens, and stale sessions.
   - Separate observed grants from inferred reachability.

3. Create a permission-drift register.
   Classify each difference as Intended approved change, Unapproved expansion, Stale retained access, Incorrect reduction, Ambiguous baseline, Compensating control dependency, or Evidence gap. Record when it began, likely cause, affected resources, exercised use, and exposure window.

4. Determine actual use and consequence.
   - Link effective permissions to observed tool calls without assuming unused access caused an incident.
   - Identify sensitive read, write, delete, execute, impersonate, delegation, and secret-access capabilities.
   - Distinguish latent exposure from confirmed use and confirmed side effect.

5. Recommend the smallest safe containment.
   Prioritize expiring or reducing the specific grant, token, role, or connector path responsible for the drift. Account for availability dependencies and emergency access. Do not recommend broad credential revocation when a narrower verified control would contain the exposure.

6. Define restoration and recertification.
   Specify the intended least-privilege state, evidence required to restore any removed capability, owner approvals, token/session invalidation checks, negative permission tests, and recurring drift detection.

If the approved baseline, effective-access evidence, or change history is missing or contradictory, request the blocking evidence once and do not close the investigation. Continue only with bounded analysis, label unresolved permissions Unknown, and state how each missing item limits containment or recertification.

Required deliverable:

# Tool Permission Drift Investigation

## Approved Boundary
| Subject or role | Allowed action | Resource | Environment | Purpose/condition | Expiry | Approval evidence |
|---|---|---|---|---|---|---|

## Effective-Access Timeline
| Time/change | Identity/credential | Effective capability | Derivation evidence | Confidence | Exposure window |
|---|---|---|---|---|---|

## Drift Register
| Drift | Classification | Baseline | Effective state | Cause evidence | Exercised? | Risk | Owner |
|---|---|---|---|---|---|---|---|

## Containment Decision
| Priority | Smallest safe action | Capability affected | Dependency risk | Authorization | Verification |
|---|---|---|---|---|---|

## Recertification Plan
- Target permission state:
- Required negative tests:
- Token/session invalidation checks:
- Owners and approvals:
- Monitoring and review cadence:
- Unresolved evidence:

The investigation is complete only when every material effective permission is reconciled to an approved purpose or listed as unresolved, excess access has a bounded containment owner, and recertification can prove both required access and denied unauthorized access.