Build an interactive security auditor that analyzes multi-step AI workflows and identifies where data or actions could cross unintended permission boundaries.
Users can define workflow steps, AI agents, connected tools, input sources, output destinations, and authorization rules.
The application must:
Map how information travels between workflow steps.
Identify steps that receive more data than they need.
Detect when confidential inputs may reach external services or unauthorized destinations.
Trace whether an agent can indirectly invoke a restricted action through another tool.
Model approval requirements for publishing, deleting, purchasing, or modifying records.
Simulate malicious inputs attempting to redirect the workflow or override its intended scope.
Generate least-privilege recommendations with explanations and affected workflow paths.
Provide a visual data-flow graph, permission matrix, attack-scenario simulator, and exportable findings report.
Use explicit rule-based checks wherever possible. Label heuristic findings as potential risks rather than confirmed vulnerabilities. Never claim that a workflow is secure merely because it passes the included tests. Keep simulated findings separate from actual enforcement and require human review before changing permissions.
0 Comments