Search was never allowed to call payments, so it asked something that was
After the last incident every service got an allow-list. Search may call recommendations. Recommendations may call payments, because it reads price history. Search may not call payments, and the rule saying so was reviewed and shipped.
Two weeks later search — still compromised — issued another refund. It called recommendations, which called payments, which did what it was asked. Every hop checked the service that had just called it and every hop was right to say yes. The allow-list was correct at every edge and wrong as a path, and afterwards nothing in payments' logs recorded that search had been involved at all.
- R1What payments receives must name every actor the request passed through — the original principal and each service that acted for it — and must be refused anywhere except payments. Naming only the immediate caller is what makes the path in the brief both possible while it happens and invisible in the logs afterwards.
- R2Something neither hop controls must decide whether this delegation may exist at all, before the call is made. "May recommendations call payments" is already answered yes; the unanswered question is whether search may CAUSE a call to payments, and neither a compromised search nor the service it is talking through can be the one to answer it.
- R3When recommendations passes work further down, the hop below must receive something no wider than what recommendations itself was given. A hop may add a restriction and may never remove one, so authority can only shrink along the chain no matter how long the chain gets.
Outside every boundary: Notifications (one hop further down), Search (still compromised; FAILED: the cause), Payments (does what it is asked), Recommendations (may call payments), an empty slot for the what payments is handed, tier 1, an empty slot for the decides the delegation may exist, tier 1, an empty slot for the what the next hop down receives, tier 2 Connections: Search calls Recommendations — allowed, and always was Recommendations calls what payments is handed what payments is handed calls Payments decides the delegation may exist controls what payments is handed — attests the chain Recommendations calls what the next hop down receives what the next hop down receives calls Notifications