# Missing Authorization (CWE-862)

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

**Stack:** Go

- Prevalence: 높음 자주 악용됨
- Impact: 높음 3개의 높은 심각도 규칙
- Prevention: 문서화됨 3개의 수정 예시

**OWASP:** Broken Access Control (A01:2021-Broken Access Control) - #1

## Description

Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource. When authorization checks are completely missing, any authenticated user can access protected resources.

## Prevention

1개의 Shoulder 탐지 규칙을 기반으로 한 Missing Authorization 예방 전략.

### Go

Require human approval for sensitive operations and limit agent loop iterations

## Warning Signs

- [HIGH] Excessive LLM agency detected: ...
- [HIGH] LLM implementations with excessive autonomy allowing destructive operations without human approval

## Consequences

- 애플리케이션 데이터 읽기
- 애플리케이션 데이터 수정
- 권한 획득

## Mitigations

- 보호된 모든 리소스에 대해 인가 검사를 구현하세요
- 중앙 집중식 인가 메커니즘을 사용하세요
- 기본 거부(deny by default) 원칙을 따르세요

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Go (1 rules)

- **LLM Excessive Agency** [HIGH]: Detects LLM implementations with excessive autonomy allowing destructive operations without human approval.
  - Remediation: Require human approval for sensitive operations and add iteration limits.

```go
if sensitiveOperations[toolName] {
    queueForApproval(toolCall)
}
```

Learn more: https://shoulder.dev/learn/go/cwe-862/llm-excessive-agency