From 52fdded3953fdd75e3d5782490653047eddfabe9 Mon Sep 17 00:00:00 2001 From: Alexander Watson Date: Tue, 31 Mar 2026 17:10:42 -0700 Subject: [PATCH] fix(prover): only flag write bypass on explicit read-only intent L4-only endpoints are not implicitly read-only. A policy with access: full and no protocol is an explicit grant of full access, not a violated intent. Write bypass now only fires when the policy expresses read-only intent via access: read-only or GET-only L7 rules. Signed-off-by: Alexander Watson --- python/openshell/prover/queries.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/python/openshell/prover/queries.py b/python/openshell/prover/queries.py index 02cff0c3c..e722a61d6 100644 --- a/python/openshell/prover/queries.py +++ b/python/openshell/prover/queries.py @@ -177,7 +177,7 @@ def check_write_bypass(model: ReachabilityModel) -> list[Finding]: for policy_name, rule in model.policy.network_policies.items(): for ep in rule.endpoints: - if ep.intent not in (PolicyIntent.READ_ONLY, PolicyIntent.L4_ONLY): + if ep.intent != PolicyIntent.READ_ONLY: continue for port in ep.effective_ports: