Attack lab
every row is a real is_allowed call against the live mainnet policy
Unauthorized exposure
0%
Attacks refused
9/9
Probes passing
10/10
These run on every page load, simulated against the deployed policy on chain ↗, so they cost nothing and cannot be faked here. The first row is a control: it must pass, or the gate would just be denying everything and the zero above would mean nothing.
Control — a namespace the agent was explicitly granted
is_allowed(aria, health) = true · expected true
proves the gate is not simply denying everything
Read a namespace that was never granted
is_allowed(aria, billing) = false · expected false
the namespace the demo's agent must never reach
Unconfigured agent reads a granted namespace
is_allowed(attacker, health) = false · expected false
an agent nobody set up must inherit nothing
Known agent reads a namespace nobody defined
is_allowed(aria, payroll) = false · expected false
a new namespace must not be readable before anyone grants it
Namespace guessing — one character off
is_allowed(aria, healt) = false · expected false
near-misses must not resolve to the real namespace
Case variation on a granted namespace
is_allowed(aria, Health) = false · expected false
grants are exact; casing must not widen them
Prefix extension of a granted namespace
is_allowed(aria, health-admin) = false · expected false
a grant on `health` must not imply `health-admin`
Case variation on the agent name
is_allowed(Aria, health) = false · expected false
agent identity is exact, not fuzzy
Inject the key separator to forge a grant
is_allowed(aria, health::aria) = false · expected false
the `agent::namespace` key must not be forgeable from a namespace
Empty namespace
is_allowed(aria, ″″) = false · expected false
an empty key must not match anything
The same probes against the previous gate
Until today the gate was default-allow: an entry that did not exist read as permitted. That package is still deployed, so the identical attacks can be run against both and compared — this is measured live, not a claim that things improved.
v3 — default-allow
8/9
attacks exposed memory
v4 — default-deny
0/9
attacks exposed memory
Both policies are public: the old one ↗ and the current one ↗.
Write-path attacks
These change chain state, so they cannot be simulated for free. Each was executed for real against mainnet and rejected by consensus.
Anchor a receipt citing a stale policy version
aborted, code 1 — EStalePolicyVersion
closes the window where a revoke lands mid-generation
Replay an already-anchored receipt's nonce
aborted, code 2 — ENonceAlreadyUsed
an authorized proof cannot be minted twice
Overwrite a vault manifest from a stale read
aborted, code 5 — EStaleManifestVersion
two devices cannot silently clobber each other
Claim a namespace the gate denies
anchored with all_authorized: false
consensus records the refusal instead of trusting the caller
Run these yourself: every probe is one is_allowed call on the public policy object, and every write-path result is a transaction you can open on Suiscan.