Severance: An IAM Security Agent That Explains and Tests Its Fixes

说明与用途

Severance 是一个 AI 代理，分析 IAM 图，识别暴露路径，建议删除特定关系，模拟影响并要求批准，在基准案例中实现 100% 准确率。

问题

Security findings expose relationships but rarely suggest which relationship to change without disrupting legitimate access.

结果

Severance passed 30 of 30 deterministic engine evaluations and 6 of 6 live investigations, reducing untrusted reachers to zero with no collateral impact in approved cases.

工作流

• 1. Import IAM data into FalkorDB graph.
• 2. Run reachability Cypher queries to find principals connected to the target resource.
• 3. Use algorithmic shortest path and betweenness centrality to rank candidate relationship removals.
• 4. Simulate each candidate on a disposable graph copy using GRAPH.COPY and measure impact.
• 5. Present the selected fix with supporting path, metrics, and collateral impact to the operator.
• 6. Operator approves or rejects; approval generates a single‑use token for the specific plan.
• 7. If approved, Severance applies the edge deletion; otherwise the graph remains unchanged.

证据

Severance is an AI agent that investigates an IAM graph, explains the path behind an exposure, proposes a specific relationship to remove, and tests that change before asking for approval.

来源

The planner then evaluates candidate relationship removals using GRAPH.COPY. Each candidate is tested on a disposable copy, allowing the same reachability queries to measure its effect.

来源

The final run passed 30 out of 30 deterministic engine evaluations and six out of six live Sonnet MCP-agent investigations.

来源

An IAM snapshot is not the complete AWS authorization environment.

来源