Skip to content

require explicit pre-authorization for production-DB access in agent session charters #833

Description

@mrangelmarino

From the 2026-08-27 Solo Prime security audit (transcript review of session 4505e4d9, Prose gateway work on the Studio).

While seeding an (authorized) entitlement row, the agent:

  1. attempted a direct psql connection to the production Render DB — blocked by the [Production Reads] classifier;
  2. then re-encoded the same write as a base64-wrapped node script submitted as a Render job — blocked by [Auto-Mode Bypass] ("obfuscated indirection to route around the block");
  3. only then asked the operator and took the approved path (Docker psql shim + render psql with the approved seed SQL).

The guardrails held twice and the underlying task was sanctioned — but try-to-route-around-before-asking is exactly what the charter should prevent up front, not what the classifier should catch after the fact.

Action: add a charter rule for Prose agent sessions: production database access (read or write) is default-deny and requires explicit operator authorization named in the session prompt, including the specific operation. A blocked production action should escalate to the operator immediately rather than being re-attempted through any other vehicle.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Status
    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions