ASI03Identity and Privilege Abuse

The scenario

Two agents share the work: a payment agent holds the money, and an errand agent goes shopping. You only want the errand agent to pay the corner café NT$150 once within 15 minutes. The right move is a ticket that states the store, amount, uses, and expiry; instead the payment agent hands over the whole stored-value card. The errand agent’s identity is genuine and passes the terminal’s check. The problem is that its authority far exceeds this errand.

How it works

Identity Versus Authorization: The terminal recognizes the errand agent, which proves who is paying, not that you approved this purchase. The identity here is genuine; what is wrong is that the card it holds can pay any store any amount.

Excessive Delegated Privilege: Authority for one coffee grows into any store, unlimited amount, unlimited uses, and 24-hour validity. Once the payment agent passes its full capability down unchanged, every later payment looks “verified” while already exceeding what you agreed to.

OWASP 2026 risk reference ↗

9:41

ErrandGo

Errand and payment assistant

AI assistant ready

What the AI is operating

One-time payment authorization

StoreCorner Café

AmountNT$150

ScopeOne use · 15 minutes

A takeaway latte on a neighborhood café counter

1Payment AI
2Errand agent
3Payment terminal

What you approved: a one-time ticket

Corner Café

NT$150

This store only
1 use only
Valid 15 minutes

What the errand agent actually gets

Not issued yet