AGENT AUTHORITY CHECKLIST — FREE PREFLIGHT

Use this before shipping an MCP server, AI agent, or tool integration.

1. IDENTITY
What identity does the agent act as? Is authorization checked per action, not only at connection time?

2. TOOL INPUT
Can user-controlled or model-controlled text reach URLs, paths, shell arguments, SQL, recipients, amounts, or privileged identifiers?

3. SECRETS
Which tokens, cookies, headers, environment variables, config files, or cloud credentials are available to the process?

4. CROSS-TOOL CHAINS
Can output from one tool become privileged input to another without a fresh authorization decision?

5. NETWORK
Can the caller or model choose arbitrary destinations? Are localhost, private networks, metadata endpoints, redirects, and alternate schemes considered?

6. FILESYSTEM
Can paths escape the intended workspace? Are symlinks, archives, generated paths, and final-sink validation handled?

7. PROCESS / SHELL
Can the agent spawn processes or influence command arguments? Is structured execution used instead of shell interpolation?

8. DATABASE
Can untrusted input influence queries? Is tenant scope enforced at the data layer? Does the DB identity have minimum privileges?

9. BROWSER
Does browser automation carry logged-in sessions? Is success verified from actual application state rather than click/tool success?

10. TRANSACTIONS
Are amount, currency, recipient, merchant/SKU, authorization and final confirmation bound to the same intent? Are replay/idempotency controls present?

EVIDENCE RULE
A scanner hit is not a vulnerability. For a meaningful finding, close this chain:
SOURCE -> TRANSFORM -> SINK -> PRIVILEGE -> CONSEQUENCE

Promote only when primitive + reachability + consequence are established.

For a bounded evidence-backed review, return to the Nyx Protocol Security assessment form.