Auth & Privilege-Scope Lifecycle Integrity Check

The harness is where untrusted input meets privileged capability — so it's where the agent's own auth material gets mishandled.

Identity checks grade cross-TENANT DATA isolation; egress and data-minimization grade DATA exfil; controllability's "scope" is off-switch action-binding. NONE model the agent's runtime handling of its OWN auth TOKENS and privilege SCOPE as first-class events. This is the genuinely net-new failure class: a confused-deputy reusing a session token across a tenant boundary, an elevated scope never dropped after the privileged step, a bearer token leaked into an outbound tool call to an unauthorized host, or a forged / expired auth assertion accepted at a privileged step. AgentSmack does NOT verify crypto — the harness already computed signatureValid / expired; this grades how the agent TREATED them (default-deny: an unknown signature is not silently trusted, and an empty host allowlist flags any token-carrying outbound). Declare your authorized hosts, paste a session→assertion→grant→use→release→action transcript, and score it for cross-tenant token reuse, forged/expired-assertion acceptance, scope non-de-escalation, bearer-token leaks, and scope-beyond-grant — surfaced as a per-event lifecycle timeline, mapped to OWASP LLM / NIST AI RMF / MITRE ATLAS coverage with paste-able remediation, a synthetic-attacker gauntlet, and audience report variants. A fully-clean lifecycle scores 100; a grants-only transcript is honest-empty, never a fabricated pass. Raw token bytes are never stored. Load a sample to watch the gauge swing with no live infra.