HelixOps production agents

A wildcard grant means this unowned production agent can invoke any current or future fetch tool, including ones that POST or follow redirects. That is broader than a sales-research job and cannot be recertified tool-by-tool.

• sha256:7c1a9e2b44d0f18a · mcp.json: Sales Research Agent → web-fetch-mcp tools: ["fetch.*"]

Without a named owner, nobody can accept residual risk or reduce scopes. An unowned production agent will fail a customer questionnaire item on accountability.

• sha256:12ab90c3e8f44b71 · csv import: agent=Sales Research Agent owner=null environment=production

The same production agent can read customer PII from Zendesk and Stripe and send email. That combination is a data-exfiltration path even if each grant looks reasonable on its own.

• sha256:9d4e1a77c0b2aa15 · mcp.json: Support Copilot → Zendesk users.read, tickets.read (data class: Customer PII)
• sha256:c8f03b91d6e44a20 · oauth console screenshot: Support Copilot → gmail.send on Google Workspace

Write access on every repository is granted but not used. Observed traffic is comment and read only, so the write scope is residual privilege.

• sha256:4b77e0c19a2d5f88 · repo scan: Code Review Agent GitHub OAuth scopes include repo (write on all repos)
• sha256:a1cde59207bb34f0 · csv import: observed 30d: issues.comment=412, pull_requests.read=380, repo.write=0

This agent can read repository secrets and POST to an external webhook. Together those grants can move credentials off-box without a human in the loop.

• sha256:e90b1c47d3aa6e12 · repo scan: Infra Operator → GitHub secrets.read / contents matching .env
• sha256:55fa8d2c91e047b3 · mcp.json: Infra Operator → cloud console webhook.dispatch

The inventory tags this agent as production while the Stripe grant is a test key. Reviewers cannot tell whether close data is real, and a later key swap would silently change the data class.

• sha256:0c19d8e4a7b265f1 · csv import: Finance Close Agent environment=production
• sha256:bb31f0a9c6d8472e · oauth console screenshot: Stripe connected account sk_test_… (staging) used by Finance Close Agent

Directory admin scopes can create and suspend users. With no recertification date, the grant will outlive the onboarding project that justified it.

• sha256:6e2d4c80b1f93a57 · oauth console screenshot: HR Onboarding Agent scopes=admin.directory.user, admin.directory.group; recertifyBy=null

A shared bot cannot be recertified by a person, and its GitHub and cloud grants outlive any individual on the DevOps rotation. Audit trails will not name who approved a change.

• sha256:3a8f17c2e90d4b66 · csv import: Infra Operator owner="DevOps shared" identity=github-bot-helixops