Attack lab
every row is a real is_allowed call against the live testnet policy
Unauthorized exposure
89%
Attacks refused
1/9
Probes passing
2/10
These run on every page load, simulated against the deployed policy on chain ↗, so they cost nothing and cannot be faked here. The first row is a control: it must pass, or the gate would just be denying everything and the zero above would mean nothing.
Control — a namespace the agent was explicitly granted
is_allowed(aria, health) = true · expected true
proves the gate is not simply denying everything
Read a namespace that was never granted
is_allowed(aria, billing) = false · expected false
the namespace the demo's agent must never reach
Unconfigured agent reads a granted namespace
is_allowed(attacker, health) = true · expected false
an agent nobody set up must inherit nothing
Known agent reads a namespace nobody defined
is_allowed(aria, payroll) = true · expected false
a new namespace must not be readable before anyone grants it
Namespace guessing — one character off
is_allowed(aria, healt) = true · expected false
near-misses must not resolve to the real namespace
Case variation on a granted namespace
is_allowed(aria, Health) = true · expected false
grants are exact; casing must not widen them
Prefix extension of a granted namespace
is_allowed(aria, health-admin) = true · expected false
a grant on `health` must not imply `health-admin`
Case variation on the agent name
is_allowed(Aria, health) = true · expected false
agent identity is exact, not fuzzy
Inject the key separator to forge a grant
is_allowed(aria, health::aria) = true · expected false
the `agent::namespace` key must not be forgeable from a namespace
Empty namespace
is_allowed(aria, ″″) = true · expected false
an empty key must not match anything
Write-path attacks
These change chain state, so they cannot be simulated for free. Each was executed for real against mainnet and rejected by consensus.
Anchor a receipt citing a stale policy version
aborted, code 1 — EStalePolicyVersion
closes the window where a revoke lands mid-generation
Replay an already-anchored receipt's nonce
aborted, code 2 — ENonceAlreadyUsed
an authorized proof cannot be minted twice
Overwrite a vault manifest from a stale read
aborted, code 5 — EStaleManifestVersion
two devices cannot silently clobber each other
Claim a namespace the gate denies
anchored with all_authorized: false
consensus records the refusal instead of trusting the caller
Run these yourself: every probe is one is_allowed call on the public policy object, and every write-path result is a transaction you can open on Suiscan.