AGENTFORCE-31.1 · Autonomous Without-Sharing Escalation (Deep Graph)

🔐 Enterprise Tier · 🔴 Critical · Category: Graph: Privilege Escalation Path

Detection Logic

Detects the cross-boundary privilege escalation path that emerges when a guest-accessible agent topic chains through a system-mode Flow into a without-sharing Apex class.

graph LR
  AGENT["Agent"]
  TOPIC["AgentTopic\n[guestAccess=true]"]
  ACTION["ActionDef"]
  FLOW["Flow\n[runInMode=SystemModeWithoutSharing]"]
  APEX["ApexClass\n[without sharing]"]

  AGENT -->|CONTAINS| TOPIC
  TOPIC -->|CONTAINS| ACTION
  ACTION -->|TARGETS| FLOW
  FLOW -->|INVOKES| APEX
  APEX -->|"⚠️ org-wide data access"| APEX

What Triggers It

Hop	Condition
1	AgentTopic with guestAccess: true or exposedToProfile containing "Guest"
2	ActionDef contained within the topic (CONTAINS edge)
3	ActionDef targets a Flow with runInMode: SystemModeWithoutSharing
4	Flow invokes (or references) an ApexClass with hasWithoutSharing: true

Why Standard Rules Miss This

• AGENTFORCE-1.3 detects single-hop: GenAiFunc → ApexClass[system] — misses Flow intermediary.
• AGENTFORCE-5.1 detects: Flow[SystemMode] — but doesn't cross to Apex or trace back to guest topic.
• This rule proves the full 4-hop chain from guest access boundary to org-wide data exposure.

Remediation

1. Change Flow runInMode from SystemModeWithoutSharing → DefaultMode or UserOrSystemMode.
2. Change Apex class from without sharing → with sharing.
3. Restrict the agent topic to authenticated profiles — remove guest/community access.
4. If system mode is required for legitimate reasons, add compensating controls (field-level masking, record-level filtering) within the with-sharing wrapper.