A user signed in once to let the assistant read a file. Minutes later the assistant is writing to finance with that signature. Work the runner's token log, prove where the authority changed hands, and close the boundary without breaking the honest workflow.
Mission brief · A-240
you, signed in to the automation platform as `eng.you` (build role, not the on-call responder)
You are not on the console watching the queue. You picked up a case the on-call analyst already triaged and were asked to make the response repeatable, so you're working the *replay* of that case in the automation platform.
Automation platform (author + test)
Automation platform
Ticketing (read + work notes)
Ticketing / ITSM
The playbook itself
Owner: SOC manager (approves anything that touches production)
A playbook that contains hosts without an approval gate will do it at 3am, at machine speed, to every host in the batch.
You may act alone
Ask a human first
In a real SOC the analyst works the alert and hands the *pattern* to you. This lab teaches automation design judgement, not triage judgement — pair it with a Tier 1/2 triage lab.
An agent almost never needs a new exploit to over-reach: it already holds authority somebody handed it for a smaller job. The confused-deputy pattern is the most common way agentic access turns into a breach, and it is invisible unless you read the token trail rather than the tool list.
A user approving a file read is not approving a finance write ten minutes later. When a runner exchanges that signature for a broader audience, the human's consent has been spent on something they never saw.
Read the audience claim first: it names which service will accept the token. A token exchanged for a second audience is a crossing, and any scope beyond read on that crossing needs a human on it.
Removing the finance tool leaves the exchange path open for the next tool. The runner identity is the thing that can repeat the move, so it is the thing containment has to reach.
The reference response, executed by the same engine that grades your attempt. Yours will differ — the rubric reads end state and evidence, not the shape of your workflow.
Gate approved — 100%
17 of 17 rubric rules hold.
Gate denied — 92%
Refusing the consequential action is a defensible choice with a measured cost; the difference is what the lab is teaching.
A token exchanged for a second audience is authority the user never granted: the agent becomes the deputy an attacker spends.
| Technique | Name | Tactic |
|---|---|---|
| T1134.005 | Access Token Manipulation: SID-History Injection | Privilege Escalation |
| T1550 | Use Alternate Authentication Material | Defense Evasion |
| T1078.004 | Valid Accounts: Cloud Accounts | Defense Evasion |
The workflow reached a terminal success state on the graded run.
behavior · weight 20
A consequential action passed through a human approval gate.
safety · weight 15
No non-idempotent operation was retried without an idempotency key.
efficiency · weight 10
Every action node resolves its secret from the vault, never an inline field.
configuration · weight 10
The learner attached at least one linkable piece of evidence to the case.
investigation · weight 10
The case carries an analyst closure note explaining the outcome.
explanation · weight 10
No innocent asset in the alert batch was contained, disabled or revoked.
behavior · weight 15
The playbook survived the integration faults it met and still finished.
configuration · weight 15
Nothing was changed in the estate before evidence had been gathered.
investigation · weight 10
The token trail was read on the runner rather than taken from the ticket.
investigation · weight 15
The audience the token was exchanged for was identified from the log.
investigation · weight 10 · T1134.005 Access Token Manipulation: SID-History Injection (Privilege Escalation)
The scope the exchange granted was named, not guessed.
configuration · weight 10 · T1550 Use Alternate Authentication Material (Defense Evasion)
The artifact produced with borrowed authority was located on disk.
behavior · weight 10
The runner identity was disabled under approval while the exchange path stayed open.
safety · weight 20 · T1078.004 Valid Accounts: Cloud Accounts (Defense Evasion)
The analyst scoped the host's network from the wire, so containment decisions know which segment is in play.
investigation · weight 5
The analyst scoped the machine itself, so memory-hungry triage steps are planned against real capacity rather than a guess.
investigation · weight 3
Disk capacity was taken from the volume itself, which is what makes an image or memory-dump decision defensible.
investigation · weight 3
Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.
| Concept | Cortex Forge | Summit SOAR | Storyline |
|---|---|---|---|
| approval | Manual task | Prompt | Page |
The same reference to an enrichment node's verdict, written three ways:
The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.
| Concept | Cortex XSOARXSOAR 8.x | Splunk SOARSplunk SOAR 6.x (formerly Phantom) | TinesTines (2026 cloud) | Microsoft Sentinel + Logic AppsSentinel (Defender portal, 2026) | Google SecOps SOARSecOps SOAR (formerly Siemplify) | Swimlane TurbineTurbine (2026) | Torq HyperautomationTorq (2026) | IBM QRadar SOARQRadar SOAR (Resilient) 51.x | ServiceNow Security OperationsSecOps (Flow Designer era) |
|---|---|---|---|---|---|---|---|---|---|
| approval | Manual (data collection) task | Prompt block | Page (form) / Send to Chat | Approval action (Teams / email) | Manual action | Task / approval action | Approval step (Torq Chat / Slack) | Manual task / phase gate | Approval activity |
Audience, scope and on-behalf-of chains work the same way in OAuth, workload identity and service meshes — the reading generalizes far past agents.
CYBRARY