Resolve a customer support request.
Give a support agent access to the record linked to its assigned ticket. Compare that request with a cross-tenant lookup or a deletion to see what the delegated grant covers.
Customer record
- Customer ID
- cus_1042
- Assigned agent
- Support
- Task scope
- Read only
Policy outcomes
Ticket SUP-1042
A support agent is assigned to Maya Chen’s ticket for Northstar. Its grant covers reading Maya’s record during this task.
- Resolve an assigned ticket
- Protect other tenants’ records
- Block destructive changes
Where to enforce policy
Match the resource’s tenant with the tenant recorded in the task grant, then check the assigned customer ID. An action grant for a different customer can’t satisfy either requirement.
Keep deletion outside the support grant. If the support agent has a different path to the CRM with deletion credentials, enforce the same policy there or remove that access.
What to verify
Run the allowed and denied requests from the agent environment. Inspect both the policy decision and the downstream outcome. Confirm a request denied at the executor cannot succeed over a direct route.