Study confused-deputy risks and least privilege

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R02 — OWASP ASVS authorization

   R10 — OWASP Authorization Cheat Sheet

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Study confused-deputy risks and least privilege. Enforce caller principal and resource ownership checks inside every tool function in application code, independent of the LLM.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Attempt to trick the assistant into using its authority to read/modify another user's note via search_notes.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Server-side tool authorization unit and integration tests.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R02OWASP ASVS↗ owasp.org

  Access-control, validation, authentication, file-handling, and logging requirements.

• R10OWASP Cheat Sheet Series↗ cheatsheetseries.owasp.org

  Authorization, SQL Injection Prevention, File Upload, SSRF, Secrets Management, and Logging Cheat Sheets.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP Cheat Sheet Series
  Authorization

  Prescribes enforcing authorization on every request at the resource layer and never trusting client-supplied identity, which is the rule your tool functions must implement independently of the LLM.

  R10S0checked 2026-11-11
• videoRana Khalil · 39:33
  Broken Access Control | Complete Guide

  Works through horizontal and vertical access-control failures with labs, showing why checking a role in the UI or prompt leaves the object-level gap open.

  R02S0checked 2026-11-11
• videoCybr · 5:47
  The Confused Deputy Attack in AWS - SCS-C03

  Shows a more-privileged service being tricked into acting for an attacker, the same shape as a tool that runs with its own credentials instead of the caller's principal.

  S3S1checked 2026-11-11
• articleAWS Identity and Access Management
  The confused deputy problem

  Explains binding a role assumption to the calling principal with source-account and source-arn conditions, the cloud analogue of passing a caller principal into every tool call.

  S3checked 2026-11-11
• labGitHub
  juice-shop/juice-shop

  Self-hosted vulnerable app whose basket and admin challenges only fall to server-side ownership checks, giving a concrete target to verify that authorization lives in code, not the prompt.

  R02S0checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.