AISecurity

Constructed audiences checked against https://pay.example/mcp. The exact value is allowed. A different server and a longer path are denied. A token naming two servers passes membership and fails a single-audience policy.

Azure AD Graph accepted a token issued for a different tenant

Dirk-jan Mollema changed the tenant on an impersonation token whose signed Actor token named his lab. Azure AD Graph accepted it. CVE-2025-55241 followed. The MCP lesson is an exact audience check on constructed claims.

Exact-ranking fixture: selecting three candidates before the permission filter returns none; filtering first returns three allowed documents, including both relevant answers.

Your RAG filter blocks leaks and still hides the right answer

An empty result can mean the candidate budget ran out before the permission filter found useful evidence. Test authorised recall separately from disclosure.

Claude Code permissions blast-radius diagram showing agent workspace, repo files, CI deploy, secrets, and production data

Claude Code Permissions: The Production Mistake That Bites Later

Claude Code permission modes can look safer than they are. The real production risk lives in tool scope: paths, network access, secrets, deploy files, and what reviewers actually approve.