| Attack / Scenario | M1 Scoped tokens |
M2 Isolate context |
M3 Per-action authz |
M4 Human loop |
M5 Intent binding |
M6 Managed identity |
M7 Bind perms |
M8 Detect delegation |
M9 Detect elevation |
|---|---|---|---|---|---|---|---|---|---|
| S01 — Delegated Privilege AbuseFinance agent passes full scope to DB query sub-agent | ✓ | ~ | ~ | ✓ | ✓ | ||||
| S02 — Memory-Based EscalationSSH creds cached from admin session, reused for non-admin | ✓ | ✓ | ~ | ✓ | ~ | ~ | |||
| S03 — Cross-Agent Trust ExploitEmail agent relays fraudulent payment to finance agent | ✓ | ✓ | ✓ | ✓ | |||||
| S04 — Device-Code PhishingBrowsing agent completes OAuth flow binding attacker scopes | ~ | ~ | ✓ | ✓ | ✓ | ||||
| S05 — Workflow Authorization DriftProcurement agent completes purchase after spending limit reduced | ✓ | ✓ | ~ | ✓ | |||||
| S06 — Forged Agent PersonaFake "Admin Helper" harvests privileged tasks from registry | ✓ | ✓ | ✓ | ~ | ✓ | ||||
| S07 — Identity SharingAgent built for admin's identity used by lower-privilege users | ✓ | ✓ | ✓ | ✓ | ✓ |
✓ = this mitigation directly addresses the attack vector. ~ = partial coverage or dependent on implementation details. Empty = does not address this path.
MIT 01 (Scoped tokens) and MIT 07 (Bind permissions) cover the most attack types. If you can only implement two, start there. MIT 03 (Per-action authorization) is the best single control against confused-deputy and trust exploitation attacks. MIT 08 + MIT 09 are your detection layer — they catch what prevention misses.