Many vulnerabilities come from mixing altitudes: the mandate is at one altitude and the grant at a higher one. Asking a chat for one call or a piece of research (an A1 or A2 mandate) hands that request an A3 agent's grant: tools, connectors, schedules, memory, reach. If the model gets enthusiastic and uses them, it acts beyond what was asked
The grant's altitude must not be above the mandate's altitude. Give an A1 mandate an A1 grant; an A2 mandate an A2 grant.
abp.sgit.ai's delta (grant minus mandate) read by altitude: every primitive an altitude holds beyond what its mandate needs is the exposure.
Also: altitude escalation (by analogy with privilege escalation) · altitude confusion (by analogy with the confused deputy)
| Mandate (asked) | Grant (given) | Risk | |
|---|---|---|---|
| A2 a chat to research a question | → | A3 an agent's grant: connectors, memory, schedules, web | it books, sends, schedules or remembers what nobody asked for |
| A2 a sub-agent to edit one file | → | A3 the parent session's full grant and tokens | it pushes, messages or starts others with the parent's name |
| A0 a CI job to run the tests | → | A3 deploy credentials and write tokens | a test dependency deploys or pushes |
| A1 an LLM call to extract a field | → | A2 tool use and a browser inside the call | a page it reads instructs it, and it acts |
Lisbon Tech Fringe is independent of Web Summit and not run by its organisers. For anything official, see the organisers' official site.