Severance: An IAM Security Agent That Explains and Tests Its Fixes

Описание и применение

Severance – это агент ИИ, который исследует граф IAM, выявляет пути экспозиции, предлагает конкретное удаление связи, симулирует эффект и требует одобрения, демонстрируя 100 % точность на тестовых сценариях.

Задача

Security findings expose relationships but rarely suggest which relationship to change without disrupting legitimate access.

Результат

Severance passed 30 of 30 deterministic engine evaluations and 6 of 6 live investigations, reducing untrusted reachers to zero with no collateral impact in approved cases.

Рабочий процесс

• 1. Import IAM data into FalkorDB graph.
• 2. Run reachability Cypher queries to find principals connected to the target resource.
• 3. Use algorithmic shortest path and betweenness centrality to rank candidate relationship removals.
• 4. Simulate each candidate on a disposable graph copy using GRAPH.COPY and measure impact.
• 5. Present the selected fix with supporting path, metrics, and collateral impact to the operator.
• 6. Operator approves or rejects; approval generates a single‑use token for the specific plan.
• 7. If approved, Severance applies the edge deletion; otherwise the graph remains unchanged.

Доказательства

Severance is an AI agent that investigates an IAM graph, explains the path behind an exposure, proposes a specific relationship to remove, and tests that change before asking for approval.

Источник

The planner then evaluates candidate relationship removals using GRAPH.COPY. Each candidate is tested on a disposable copy, allowing the same reachability queries to measure its effect.

Источник

The final run passed 30 out of 30 deterministic engine evaluations and six out of six live Sonnet MCP-agent investigations.

Источник

An IAM snapshot is not the complete AWS authorization environment.

Источник