vulns.co
/
GKData.io MCP

Conceptual model · 1 min read

Approval stays attached to the reviewed version

Editorial conceptual model derived from the linked cases and official guidance; not a vendor architecture diagram or an exploitation sequence.

The conceptual model

Reviewed content and its immutable version are bound to an approval. Execution independently checks that the version still matches. Matching requests proceed with least privilege; mismatches require a new review.
Reviewed content and its immutable version are bound to an approval. Execution independently checks that the version still matches. Matching requests proceed with least privilege; mismatches require a new review.
Full-size SVG ↗Mermaid source ↓Graphviz source ↓

Cases and references behind the model

DisclosureCloud Build approval was not bound to immutable code ↗DisclosureGitHub Actions trust depended on invalid repository references ↗ReferenceAuthorization Cheat Sheet ↗ReferenceOWASP Transaction Authorization ↗

Sources and provenance

  1. adnanthekhan.com Primary source
  2. blog.teddykatz.com Primary source
  3. cheatsheetseries.owasp.org Primary source
  4. cheatsheetseries.owasp.org Primary source

Record reviewed 2026-10-02. Snapshot d5550c789111. Open the complete JSON contract.

GitHub snapshot 2026-10-04

d5550c789111 · JSON exports & schemas · CC BY 4.0 content / MIT software