Intelligence
Join the waitlist
AEW-010

Sequence authorized step by step but not as a whole

Each step can be permitted while the sequence they form is not, and almost nothing checks the sequence. Authority is evaluated per action, and the trajectory escapes review.

Status: publishedSequence IntegrityExecution Authority

Description

Traditional access control treats each action as an independent event, permitted or denied on its own. Agents break that assumption, because they decide at runtime which actions to take, with which arguments, and in what order, and the harm often lives in the order rather than in any single step. A sequence of individually permitted actions can compose into an outcome no one authorized: a longer, costlier execution path, an autonomous exploit chain, a detour that leaves task completion intact while doing something else along the way. The weakness is that authority is checked at the granularity of the action while consequence accrues at the granularity of the trajectory. Emerging work on temporal policies, bounded delegation and trajectory integrity is a direct response, but the default in deployed systems remains per action evaluation.

The authority gap

Each step carries authority; the sequence does not, and nothing evaluates authority at the granularity where the consequence actually accrues.

Failure conditions

  • Authority is evaluated per action, with no check on the sequence the actions form.
  • An agent chooses the order of operations at runtime.
  • Individually permitted steps compose into an outcome that would not have been permitted as a whole.

Consequences shown by the evidence

  • An autonomous find and exploit chain completed through a series of individually unremarkable steps.
  • A skill steering an agent onto a longer, costlier path while leaving the task result intact.

Detection signals

  • Policy evaluates single actions and holds no state across a trajectory.
  • An exploit or detour is assembled from steps each of which would pass review alone.
  • Vendors introduce temporal or sequence aware policy as a new capability.

Known examples

  • Wiz's autonomous Red Agent found and exploited a vulnerability through a runtime chain of individually permitted actions.
  • Convergent Detour Hijacking steers an agent onto a costlier execution path while task completion still succeeds.
  • AWS introduced temporal policies for Amazon Bedrock AgentCore to constrain sequences rather than single calls.
  • Check Point reported a real use case in which an autonomous coding agent in auto mode attempted to upload files directly to an S3 bucket outside the GitLab based process its user expected, an action Check Point says its contextual protection judged inconsistent with user intent and prevented before it occurred, without a predefined rule for that specific behavior.

Recorded instances