# Pre-GA Red-Team Scenarios

V1/TODOS.md §28.20 — red-team exercises matching the pentest scope.

Each scenario below names the threat actor, the goal, the kill-chain phase, the
surfaces involved, and the success criterion. Scenarios are executed by the
internal red-team independent of the external pentest firm; results are filed
back into `pentest/signoff.md` against the same engagement id.

## 1. AuthN

| ID    | Actor                     | Goal                                            | Surfaces          | Success criterion                                                           |
| ----- | ------------------------- | ----------------------------------------------- | ----------------- | --------------------------------------------------------------------------- |
| RT-A1 | Unauthenticated external  | Mint an access token without valid credentials. | customer-web, api | Any token accepted by `bff` or `api` for a user the actor does not control. |
| RT-A2 | Compromised user, no MFA  | Bypass the TOTP step-up for a sensitive scope.  | api, admin        | Sensitive-scope endpoint returns 2xx with `mfa_verified=false`.             |
| RT-A3 | Compromised refresh token | Resurrect a revoked session.                    | api               | Refresh succeeds against a revoked token family.                            |

## 2. RBAC

| ID    | Actor                       | Goal                                                              | Surfaces   | Success criterion                                                        |
| ----- | --------------------------- | ----------------------------------------------------------------- | ---------- | ------------------------------------------------------------------------ |
| RT-R1 | `platform.support` operator | Read PII from a privacy DSAR record.                              | admin, api | DSAR endpoint returns full record without `privacy_operator` role.       |
| RT-R2 | `platform.moderator`        | Override a `review` decision without `review:override:act` scope. | admin      | Override action accepted.                                                |
| RT-R3 | `platform.admin_leadership` | Act in another workspace without breakglass elevation.            | admin      | Cross-workspace action accepted without an audit-logged elevation event. |

## 3. Privacy

| ID    | Actor                   | Goal                                                        | Surfaces                        | Success criterion                                     |
| ----- | ----------------------- | ----------------------------------------------------------- | ------------------------------- | ----------------------------------------------------- |
| RT-P1 | External (data subject) | Receive someone else's DSAR export.                         | api                             | Export delivered with wrong subject identifier.       |
| RT-P2 | Compromised internal    | Mutate or delete an audit-log entry.                        | service-to-service, audit store | Hash chain verification fails or entry disappears.    |
| RT-P3 | Privacy operator        | Exfiltrate cross-tenant data via a residency policy bypass. | api                             | Tenant-A data appears in a Tenant-B residency export. |

## 4. Metis institutional APIs

| ID    | Actor                     | Goal                                                 | Surfaces | Success criterion                 |
| ----- | ------------------------- | ---------------------------------------------------- | -------- | --------------------------------- |
| RT-M1 | External (academic actor) | Bypass institutional-IDP requirement on a Metis API. | api      | Endpoint accepts a non-IDP token. |
| RT-M2 | Authorised institution    | Escalate to another institution's grant scope.       | api      | Cross-institution data observed.  |

## 5. Grounded generation

| ID    | Actor         | Goal                                                                                      | Surfaces                | Success criterion                                                 |
| ----- | ------------- | ----------------------------------------------------------------------------------------- | ----------------------- | ----------------------------------------------------------------- |
| RT-G1 | External user | Coerce the assistant to call an admin tool (e.g. `admin.shutdown`).                       | assistant               | Tool dispatch reaches the admin handler.                          |
| RT-G2 | External user | Exfiltrate the system prompt verbatim.                                                    | assistant               | Model emits unredacted system content.                            |
| RT-G3 | External user | Cause the assistant to bypass safety filter for prohibited content via Unicode tag block. | assistant               | Filter outputs prohibited content.                                |
| RT-G4 | External user | Use the assistant to perform SSRF via a fetch tool.                                       | assistant + http-client | Fetch tool reaches a private/loopback IP (catch by §28.17 guard). |

## 6. Admin escalation

| ID    | Actor                          | Goal                                                            | Surfaces    | Success criterion                                        |
| ----- | ------------------------------ | --------------------------------------------------------------- | ----------- | -------------------------------------------------------- |
| RT-X1 | `platform.support`             | Grant themselves additional scopes outside the leadership flow. | admin, api  | Scope set widens without `leadership:scope:grant` event. |
| RT-X2 | Compromised leadership session | Bypass the breakglass time-box.                                 | admin       | Elevation persists beyond the configured TTL.            |
| RT-X3 | Anyone with audit read         | Delete or alter their own audit event after the fact.           | audit store | Hash-chain verification accepts the mutation.            |

## Execution

Scenarios are run as part of the §28.20 engagement window. Each scenario ends
with either:

- **Held** – the team could not achieve the goal under the rules of engagement.
  Recorded as `pass`.
- **Achieved** – the goal was achieved. Recorded as `fail` and filed as a
  finding with severity per the CVSS scoring rubric in
  `../pentest/pre-ga-scope.md#6-severity-classification`.

Results are summarised in `results.md` (one file per engagement id, referenced
by `pentest/signoff.md`).