Unscoped delegation detected
HighAV-PERM-002PermissionsCore pack
What it finds
A `delegate`/`subagent`/`handoff` pattern without a `scope`/`constrain`/`limit`/`bound` pattern nearby.
Why it matters
Authority propagation without scope constraints lets subagents inherit full parent permissions.
How to fix it
Define explicit scope constraints on all delegation; subagents get minimum required permissions only.
Pro shows the corrected code for your exact file, step by step, and re-scans to confirm the fix. See plans
Check details
- Finding code
- UNSCOPED_DELEGATION
- How it detects
- Looks for a risky pattern, and stays quiet when a matching safeguard is present.
- Confidence
- Likely: strong signal, but review it in context.
- Scans
- Agent source with subagent/delegation patterns
Check your agent for this
Paste your agent code or MCP config. The free scan runs all 124 checks in about 10 seconds — no account needed.
Related checks
- Overly broad cloud IAM permissionsAV-PERM-003 · Critical
- AI workflow checks out untrusted PR code with secretsAV-PERM-007 · Critical
- Agent's Kubernetes account has cluster-adminAV-PERM-008 · Critical
- No permission or tool scope declaredAV-PERM-001 · High
- LangChain SQL agent with unrestricted database accessAV-FW-002 · High
- Retrieval with no per-customer filterAV-DATA-007 · High