agent misread the finding and rotated the wrong key: logic error
Prevents an agent from misreading a finding and rotating the wrong key: confirm the target before acting. Use when rotation targets are ambiguous. Not for failed rotations.
TL;DR
The agent rotated a key that was not the leaked one because it matched loosely. Require exact target confirmation: the finding's key identifier must match the rotation target exactly, with a human-readable diff shown before acting.
Error
agent misread the finding and rotated the wrong key: logic errorSteps
- Reconstruct the misread: which finding, which key was rotated, and why they were confused. Expected: the confusion understood.
- Require exact identifier matching between finding and rotation target. Expected: no fuzzy matches.
- Show a pre-rotation diff: what will be rotated, where it is used. Expected: reviewable plan.
- Add a confirmation gate for production keys. Expected: human check on blast radius.
- Revert the wrong rotation and rotate the correct key. Expected: the real leak fixed.
When to use
- Wrong-key rotations.
- Building safe rotation agents.
When not to use
- Rotations failing technically.
- The correct key was rotated (then it is a verification issue).
Tool compatibility
- Key identifiers; rotation gates.
Variant phrasings
rotated the wrong key
Confirm targets.
agent misread the finding
Exact matching.
Why it happens
Findings carry similar-looking identifiers; agents that match loosely pick the wrong one.
Edge cases
- Reverting a wrong rotation is itself a rotation; do it carefully.
- Confirmation gates must not be bypassable by the agent.
- Log the target decision for every rotation.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_t8WQcQQEAlrvlSYYzhzj8Q