Excessive Permission Scope

What Foo Guard detects

One or more permissions have an explicitly unrestricted resource scope without wildcard flagging.

When this rule triggers

a non-wildcard permission has an explicitly unrestricted resource scope. Ambiguous scope names alone do not trigger this rule.

Foo Guard evaluates the normalized configuration supplied to the scanner. A finding describes configuration risk; it does not establish that an attack occurred. An absent finding does not prove that an undeclared capability is safe.

How to fix

Restrict resourceScope to the actual resources needed. Confirm that the identity provider or target system enforces the same restriction.

Verify the change

Update the actual agent configuration and the underlying permissions or controls, then run the scanner again. Inspect the finding’s evidence path to confirm the intended setting changed. Do not clear a finding by changing a declaration that no longer reflects the deployed agent.