Cross-Resource Unrestricted Access

What Foo Guard detects

Multiple permissions grant explicitly unrestricted access across resources.

When this rule triggers

at least two permissions have explicitly unrestricted resource scopes.

Foo Guard evaluates the normalized configuration supplied to the scanner. A finding describes configuration risk; it does not establish that an attack occurred. An absent finding does not prove that an undeclared capability is safe.

How to fix

Review each broad permission together with the others. Narrow the resources for each operation rather than relying on the agent’s intended task as a boundary.

Verify the change

Update the actual agent configuration and the underlying permissions or controls, then run the scanner again. Inspect the finding’s evidence path to confirm the intended setting changed. Do not clear a finding by changing a declaration that no longer reflects the deployed agent.