Stop Stale Agent Jobs
Recheck permission before queued agent work executes after a role change, cancellation, or lease expiry.
An agent may queue a job while a user still has access. The user can lose that access before the worker runs. A queue message that carries an old "approved" flag can still perform a write after membership removal unless the worker rechecks authority at execution time.
Treat a queued action as a proposal with a lease, not a permanent grant. Store the actor, tenant, exact action, resource, authorization version, and expiry. Avoid putting raw credentials in the queue payload. OWASP's authorization guidance calls for checks on protected requests; the worker is a new execution point and needs its own check.
Job state contract
| State | Allowed transition | Required check |
|---|---|---|
| Proposed | Queue after validation | Caller can request the action |
| Waiting | Hold for approval or schedule | Lease has not expired |
| Ready | Worker claims once | Current role and tenant membership |
| Running | Execute bounded step | Cancellation and stop condition |
| Finished | Record effect | No duplicate execution |
| Canceled | Terminal | No later retry can revive it |
For a multi-step job, check permission before each irreversible effect. A long report generation job may continue internal computation after access removal, but it should not publish or deliver the report. Define which cleanup actions are allowed after cancellation. A retry must preserve the original action digest; changing arguments requires a new decision.
Revocation test
Use a synthetic account and a disposable action. Queue the action, remove the user's role, then release the worker. It must deny the effect and record why. Repeat with an expired lease, a canceled job, and a duplicate queue delivery. Keep a positive control where permission remains current and the job completes once.
Inspect the external side effect, not just the job status. Some workers report failure after making the call. Record job ID, policy version, actor, decision time, and result without copying tokens or private payloads. If the system cannot cancel or reauthorize a pending high-impact job, do not expose that action to an agent yet. A model's final answer cannot revoke a job already accepted by the queue.
Know what your agents can reach
Map data access, tool actions and approval boundaries before testing. Use the scope guide, or discuss a review of your AI application.
Sources
- OWASP Top 10 for LLM ApplicationsAccessed
- OWASP Authorization Cheat SheetAccessed