Appearance
Pen-test schedule: claim & authz
Process for a periodic adversarial review of LivePane claim pairing and authorization. This is a manual / process schedule, not an automated test suite. Closing the documentation ticket does not require running a live pen test — it only requires this schedule and scope to exist and stay discoverable.
Cadence
| Setting | Value |
|---|---|
| Cadence | Quarterly (once per calendar quarter), plus an extra pass after material claim/authz design changes |
| Owner | TBD — security owner (placeholder; assign a named person or role before the first scheduled run) |
| Trigger (ad-hoc) | Large changes to claim lifecycle, machine tokens, WorkspaceAccess / PaneAccess, invites/roles, or capability catalog surfaces |
Record the planned window (e.g. “Q3 2026”) and owner in the team calendar or security runbook when the placeholder is filled.
Scope (in)
Adversarial review should exercise positive and negative authz: authorized actors succeed; unauthorized actors get 401/403/404 as designed (no silent success, no cross-tenant leak).
Claim start / complete
| Focus | What to exercise |
|---|---|
| Claim start | Agent (or unauthenticated caller) starts claim; codes are short-lived; cannot mint usable machine identity without owner confirm |
| Claim complete / confirm | Only workspace owner can confirm; non-owners and outsiders rejected; expired / replayed codes fail closed |
| Claim complete (agent) | Completing with a valid code yields machine credentials only for the intended workspace/machine; no cross-workspace bind |
See product flow: Claim a machine.
Machine-token auth
| Focus | What to exercise |
|---|---|
| Heartbeat / agent API | Machine (device) token authenticates agent heartbeats and command paths; user SPA/PAT cannot impersonate a machine without that secret |
| Token rotation / unclaim | After unclaim or token invalidation, old machine credentials stop working |
| Scope | Machine token cannot act as a user session or mint broader PATs |
WorkspaceAccess / PaneAccess
| Focus | What to exercise |
|---|---|
WorkspaceAccess | Membership, owner, and create-grant checks are the only choke for workspace authz (HTTP controllers and capability authorize()). Non-members cannot list or mutate workspace resources |
PaneAccess | Pane control / watch rules (controller, invitees, create-grant) hold under direct ID probes and capability invokes |
| Drift | Same decision for HTTP vs capability catalog for the same action (no “works on one surface only” bypass) |
Invite / role paths
| Focus | What to exercise |
|---|---|
| Workspace invitations | Invite, accept, revoke; role after accept matches intended membership; revoked invites unusable |
| Create grant | Members without create grant cannot create panes / drive freeform agent work; owners can grant and revoke |
| Pane invites | Invitees get intended watch/control only; no workspace-wide escalation from a single pane invite |
Capability catalog surfaces
| Focus | What to exercise |
|---|---|
| Surfaces | Authz on http, mcp, cli, and agent catalog paths for claim-adjacent and workspace/pane capabilities |
| PAT profiles | Scoped developer PATs cannot exceed profile abilities; privileged / system capabilities stay off product mounts |
| Catalog parity | No sensitive capability reachable without matching authorize rules (see MCP & CLI) |
Scope (out)
- Full automated red-team suite in CI (this doc is process only)
- Generic web/app XSS/CSRF beyond claim/authz impact (see Session security)
- Full MFA product or path-allowlist product implementation (see Agent residual risk)
- Non-authz performance or UX reviews
Method (lightweight)
Not a fixed vendor SOW. Minimum bar for each scheduled run:
- Threat notes — short list of abuse cases for claim start/complete, machine token, WorkspaceAccess/PaneAccess, invites, catalog.
- Manual adversarial checks — scripted or hand-held requests against staging (or a dedicated env): wrong role, wrong workspace, expired claim code, stolen-looking machine token, capability invoke without membership.
- Code path skim — confirm new endpoints/caps still call
WorkspaceAccess/PaneAccess(or claim domain authorities) rather than ad-hoc membership queries. - Findings triage — severity, owner, ticket; fix or accept risk with rationale.
Automated unit/feature tests remain the day-to-day regression net; this quarterly pass is for authz design gaps and dual-surface drift that tests may miss.
Evidence to keep
After each run, retain enough to prove the review happened and what was found. Prefer a private security store or issue tracker — not production secrets in this docs package.
| Artifact | Purpose |
|---|---|
| Date + env | When and where (staging URL / build id) |
| Owner / participants | Who ran the review |
| Scope checklist | Claim start/complete, machine token, WorkspaceAccess/PaneAccess, invites/roles, capability surfaces — checked off |
| Findings | ID, severity, repro summary, status (open / fixed / accepted) |
| Follow-up tickets | Links to issues for remediations |
| Attestation | One-line “Q* YYYY pen-test claim+authz complete” in calendar or security log |
Do not commit live claim codes, machine tokens, SPA tokens, or production credentials into the repo.
What this page does not claim
- No live pen test is required to publish or “complete” this documentation page.
- No automated pen-test suite is shipped or mandated by this page.
- No guarantee that a quarterly pass finds every bug — it is a scheduled adversarial review with a fixed scope checklist.
- Owner is a placeholder until a named security owner is assigned.
Related
- Claim a machine — owner claim pairing flow
- Session security — SPA tokens, revoke-all, XSS residual risk
- Agent residual risk & least privilege — freeform agent surface, deferred MFA / path policy
- MCP & CLI — capability surfaces and PAT profiles