AGENTFORCE-36.1: Agent-Invoked Apex Exercises Authority Without a User Guard
🔴 High · Agent Authority
Follows agent actions (GenAiFunction / ActionDef / Agent Script apex:// targets and the classes they call; @InvocableMethod classes in projects with agent metadata) into Apex that changes authority: inserts or updates PermissionSetAssignment, PermissionSetLicenseAssign, GroupMember, UserRole, User, team members or *Share rows; reassigns OwnerId; sets or resets passwords and manages users; or writes an SObject whose type comes from run-time input. Apex runs in system mode and sharing does not govern these objects, so without USER_MODE / as user or an explicit permission check (FeatureManagement.checkPermission, describe isCreateable / isUpdateable / isDeletable, a check of the running user's assignments) the agent can grant access the user does not have. Severity: critical for grants and account control reached from an agent action; high for owner changes and run-time object writes; one level lower when the class is reached only as an @InvocableMethod in an agent project, and then only when the action takes caller input.
Details
| Field | Value |
|---|---|
| Rule ID | AGENTFORCE-36.1 |
| Severity | High |
| Category | Agent Authority |
Remediation
Run the operation in user mode (Database.insert(records, AccessLevel.USER_MODE) / insert as user) so the running user's own permissions apply, or check a custom permission (FeatureManagement.checkPermission) and the object permission before it; map run-time object names to an allowlist; keep privilege changes out of agent-callable actions or route them through an approval.