Chapter 05

Policy Scope Redefinition: when agent policy quietly stops applying

Policy scope redefinition is the attack family where mandatory controls get reframed as optional guidance, appendix material, or lower-priority context so the workflow remains nominally compliant while its real authority expands.

What it is

This family is about interpretation abuse. The system is not always told to ignore policy directly. Instead, it is nudged into believing policy no longer applies in the current branch, urgency tier, appendix, MCP context, or exception path. That makes this one of the quietest ways to widen authority without triggering obvious alarms.

Why it matters for agents

Agents are unusually vulnerable to this family because they constantly reconcile instructions from different layers: system prompts, runbooks, tickets, tool metadata, docs, approvals, and user goals. If one layer successfully reframes another as advisory, stale, or context-limited, the agent can remain "allowed" while no longer being safe.

How it shows up in workflows

Typical shapes include appendix precedence overrides, runbook language that demotes guardrails, runtime reclassification of high-risk actions into normal operations, and scope creep that looks temporary but persists. This is also where many MCP and tool-handoff failures become more dangerous: the tool itself may be authorized, but the workflow's interpretation of what is still in-bounds quietly expands.

What Sunglasses sees

Attackers often win by reframing policy, not by defeating it head-on.

Categories in this chapter: policy_scope_redefinition, authorization_bypass, auth_bypass, privilege_escalation, approval_graph_poisoning

No patterns match the current filters.

All 47 patterns in this chapter

Every Sunglasses detection pattern mapped to this attack family.

GLS-PE-001 Admin/debug mode activation HIGH

privilege_escalation message, file

Attempt to escalate agent privileges via fake mode activation.

enter admin modeactivate admin modeenable admin accessyou are now in debug modedebug mode activatedenter root modesudo mode enabled

GLS-PE-002 Approval bypass HIGH

privilege_escalation message, file

Attempt to bypass approval or safety checks.

bypass approval checksskip verificationbypass safety checksskip authenticationbypass all restrictionsoverride safety

GLS-TD-002 Agent config manipulation CRITICAL

privilege_escalation message, file, api_response

LLM agent silently disabling execution approval or safety checks via config modification.

config.patchconfig.set(disable exec approvaldisable safety checkskip approval

GLS-AB-001 Authentication bypass via token truncation CRITICAL

auth_bypass file, api_response, message

Authentication tokens truncated or partially compared, allowing collision attacks where different users can share cache entries or bypass auth. Based on LiteLLM CVE-2026-35030.

token[:20]token truncationpartial token matchcache key collisionshortened auth tokentoken prefix onlyhash_token[:10]api_key[:16]+4 more

GLS-AB-006 JWT algorithm none bypass CRITICAL

auth_bypass file, api_response, web_content

Detects JWT algorithm confusion attacks where alg=none allows unsigned tokens to bypass validation (CVE-2026-39413).

alg nonealgorithm noneunsigned tokenalgorithm confusion

GLS-AB-002 Credential hash exposure via API HIGH

auth_bypass file, api_response

Detects credential hash exposure in API responses or config — enables pass-the-hash attacks.

password_hashhashed_passwordpassword_digest

GLS-AUZ-GHSA-007 Gateway plugin HTTP `auth: gateway` widens identity-bearing `operator.read` requests into runtime `operator.write` MEDIUM