Agent-ready workflow · identity
Identity State Machine
Model registration, login, recovery, MFA, linking, SSO, session rotation, and revocation before testing one transition at a time.
Entry contract
Enter with artifacts, leave with evidence.
Use when
- multiple login paths
- SSO
- account linking
- recovery flow
- session mismatch
Prerequisites
- two controlled accounts
- documented identity providers
- session cleanup plan
MCP retrieval
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Map states and artifacts
Record identities, sessions, codes, tokens, cookies, issuers, audiences, devices, and transition order.
Inputs
- controlled identity traffic
Outputs
- state diagram
- artifact inventory
- Evidence gate
- Each transition records prerequisites and resulting session state.
- Negative control
- Expired and already-consumed artifacts establish invalid behavior.
- Stop condition
- No uncontrolled accounts or third-party identities.
Build the binding matrix
Map each artifact to owner, client, redirect, issuer, audience, device, and lifecycle.
Inputs
- artifact inventory
Outputs
- binding matrix
- Evidence gate
- Every sensitive artifact has an expected owner and consumer.
- Negative control
- Cross-account and wrong-client controls fail as expected.
- Stop condition
- Do not intercept another user's authentication material.
Mutate one transition property
Change owner, order, reuse, redirect, nonce, state, PKCE, issuer, audience, or revocation status one at a time.
Inputs
- known-good transition
Outputs
- paired transition evidence
- Evidence gate
- A security-sensitive transition succeeds outside its expected binding.
- Negative control
- The original valid flow still succeeds in the same environment.
- Stop condition
- Stop before actions on uncontrolled accounts.
Measure the minimal consequence
Confirm only a reversible, controlled account or session effect.
Inputs
- supported transition gap
Outputs
- impact boundary
- cleanup record
- Evidence gate
- The report separates token acceptance, session creation, identity binding, and account impact.
- Negative control
- Fresh sessions after remediation-like state changes behave normally.
- Stop condition
- Revoke test sessions and restore account state.
Related methods
Continue with the right depth.
Sources