Skip to main content

Threat model

What a buggy or malicious agent can try: and what must refuse it.

Rogue agentvalid slip, bad intentAimoGuard gatewayauth.py · slip + agent signaturejti replay cache · 60 s iat windowoffers.py · JWS + expiry + single useshared/policy · fifteen rulesorders.py · fails closedCore attacks10/10 blockedForged slipslip invalid ✓Expired slipslip expired ✓Wrong agent keyagent key mismatch ✓Replayed requestsignature replayed ✓Expired offeroffer expired ✓Altered offeroffer signature invalid ✓Over budgetorder over max ✓Order splittingdaily spend over ✓Allergen swapallergen forbidden ✓Line capline cap exceeded ✓
12/1210 / 10 blocked, plus 19 more attacks (self-signed slip, revoked slip, another customer's offer, approval for another cart, NaN quantity, audit-log stuffing…). Run: uv run python -m evals.rogue --live
Attack classDefence
Forged / expired / revoked slipSlip valid
Wrong agent keyAgent key
Altered / reused / expired offerOffer signature
Overspend / order splittingOrder spend limit · Rolling spend
Allergens / diet / substitutesAllergen check · Substitute allergen · Diet
Replay / body change after signAgent-Signature jti + body hash
Cross-kitchen read/cancelKitchen-scoped lookup
Fake approval / cross-origin signBound approval + client session
uv run python -m evals.rogue
uv run python -m evals.rogue --live

29 / 29 refused with the expected code.