Problem/Motivation

Grant-time allowlist and Status report drift checks close elevation and visibility gaps. They do not address already-active grants: if an operator widens mcp_admin (or flips is_admin) while a user still holds the role until TTL, that session keeps the widened capability until the reaper runs.

Proposed resolution

  • On cron (alongside reapExpired()), if mcp_admin is missing, is_admin, or holds extras outside the allowlist: force-revoke all active grants and remove the role from holders; audit with reason role_posture_unsafe.
  • Do not force-revoke for “narrower than allowlist” alone (WARNING-level drift).

Related

GitHub: #89. Follow-on after grant-time seal and status drift (d.o #3614163, #3614164).

Comments

jmcerda created an issue. See original summary.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Issue summary: View changes
Status: Active » Needs review

Needs review: implemented in GitHub PR #95 (companion #89).

Cron force-revokes active grants when mcp_admin is missing, is_admin, or holds allowlist extras; audit reason role_posture_unsafe. CI green; awaiting human merge to 1.x, then this can move to Fixed with the next release.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Status: Needs review » Fixed

Fixed in PR #95 (merged to 1.x).

GitHub companion #89 closed as completed.

Live-grant posture revalidation (`reapUnsafePosture`, audit reason role_posture_unsafe).

Will land in the next tagged release after 2.2.0.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

jmcerda’s picture

jmcerda
Location Boca Raton, FL
commented
Issue summary: View changes
Status: Fixed » Closed (fixed)

Closed (fixed): live-grant posture revalidation (cron force-revoke on unsafe mcp_admin) shipped on 1.x via GitHub PR #95 (GitHub #89). Will be in the next release after 2.2.0.

https://github.com/Wilkes-Liberty/mcp_sentinel/pull/95
https://github.com/Wilkes-Liberty/mcp_sentinel/issues/89