What can your agent actually reach?

Map four layers.

1. 01Tool

   List every tool the agent can call and the action it is meant to perform.

2. 02Identity

   Identify the token, service account or role behind each call.

3. 03Trust

   Follow role assumption, delegated access and shared credentials.

4. 04Resource

   Record the data and operations available at the end of each route.

Look beyond the tool name.

A file-search tool may use a credential with access to an entire storage account. A deployment tool may assume a role that can also change identity policy. What a tool is for and what it can do are separate facts.

• Check inherited roles as well as direct grants.
• Include credentials reused by other workloads.
• Record network restrictions, resource policies and approval gates that may block a route.

Turn the map into changes.

For each unnecessary route, identify the smallest control that breaks it. That may be a narrower role, a separate identity, a resource policy or an approval check at execution. Retest the workflow after the change so the legitimate task still works.

Keep the map current.

Repeat the review when tools, models, identities or resource policies change. Keep ownership and exceptions beside the access record, with a date for the next review.

What the map cannot prove.

Permissions on paper show possible routes. They don't prove an attacker can use every one. Runtime checks, conditional policy and application behaviour can change the result. Validate critical routes in an authorised environment.

Illustrative access map.

A fictional route. It doesn't prove that a production resource is reachable.

1. 01Tool: document search

   Intended task: retrieve approved support documents.

2. 02Identity: support-agent-reader

   The workload role has an inherited storage grant.

3. 03Permission: read all collections

   The grant is wider than the support-document boundary.

4. 04Resource: internal archive

   Check resource policy and runtime denial before concluding that this route works. A scoped change should deny this archive while preserving approved search.

Where this method comes from.

This is a Riftweld access-review method. The evidence comes from your real tool definitions, the access your identity and resource policies actually grant, and controlled tests. It doesn't draw on data from other companies, and it can't promise to find everything.