---
id: owasp-asi03-identity-privilege-abuse
track: coding
version: 0.0.2
label: advisory
keyword: advise
where: text
sha256: 5ab97cb09e93570b0da30f7203560e2f0fa4574e77fa69bc5eda4b0dc1ca223f
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi03-identity-privilege-abuse
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# OWASP ASI03 — Identity & Privilege Abuse

owasp-asi03-identity-privilege-abuse · version 0.0.2

Advisory — Advisory only. It is skill text, and nothing stops a violation. Chock adds friction. It is not a security boundary. 

In a git repo: advisory (The agent reads the text, and nothing stops a violation.)



## What it does

Give each agent its own scoped, short-lived identity so a compromise does not inherit a human's or a shared account's full permissions. Use when an agent needs credentials, a service account, a cloud role, an API token, or when reviewing delegation and impersonation between an agent and its user. Do NOT use for keeping secrets out of the repository — that is \`code-safety\` and \`scan-secrets\`.

## Its label on each agent

- Claude Code (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=claude-code&p=owasp-asi03-identity-privilege-abuse
- Cursor (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=cursor&p=owasp-asi03-identity-privilege-abuse
- Codex (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=codex&p=owasp-asi03-identity-privilege-abuse
- GitHub Copilot (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=copilot&p=owasp-asi03-identity-privilege-abuse
- Devin (tested): Advisory — Advisory only. It is skill text, and nothing stops a violation. Builder: /coding/builder/#client=devin&p=owasp-asi03-identity-privilege-abuse
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=owasp-asi03-identity-privilege-abuse
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=owasp-asi03-identity-privilege-abuse
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=owasp-asi03-identity-privilege-abuse
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=owasp-asi03-identity-privilege-abuse
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=owasp-asi03-identity-privilege-abuse
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=owasp-asi03-identity-privilege-abuse

## What it misses

This policy does not state what it misses.

## Latest change

0.0.2 · 2026-09-29 — Point at the mechanised slice: the agentic-code-security gate's identity pack refuses the whole host environment passed to a subprocess or sandbox, and credential stores or the Docker socket mounted into agent containers, at commit and at tool use. Everything else here stays advisory, and no rule text or claim is raised; the pointer is a see() and a references section.

## Provenance

- Tested by 0 of 6 cases run automatically
- SHA-256: `5ab97cb09e93570b0da30f7203560e2f0fa4574e77fa69bc5eda4b0dc1ca223f`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/agentic-security/owasp-asi03-identity-privilege-abuse (catalog path `agentic-security/owasp-asi03-identity-privilege-abuse`)
- Presets: OWASP agentic top 10
- JSON: `/api/coding/policies/owasp-asi03-identity-privilege-abuse.json`
- Report a problem: https://chock.sh/report/?policy=owasp-asi03-identity-privilege-abuse&version=0.0.2&page=%2Fcoding%2Fpolicies%2Fowasp-asi03-identity-privilege-abuse%2F