## TL;DR
The agent parsed the approval webhook loosely and applied it to the wrong contractor. Validate the webhook against a strict schema, match the contractor by unique ID, and confirm the grant before applying.

## The query
```text
agent granted vpn access to the wrong contractor: approval-webhook misparse
```

## Use this when
- VPN access granted to the wrong contractor
- the approval payload was ambiguous
- contractor names are similar

## Not for
- VPN tunnel failures
- approval workflow design
- revoking access

## Steps
1. Revoke the wrongly granted access immediately. Expected output: the wrong contractor cannot connect.
2. Find the misparse: which field the agent read and what it should have read. Expected output: the parsing bug is identified.
3. Validate approval webhooks against a strict schema; reject anything ambiguous. Expected output: malformed approvals never process.
4. Match the contractor by unique ID, never by name. Expected output: the grant targets exactly one identity.
5. Grant the correct contractor access and verify. Expected output: the right person connects, no one else.

## Applies to
VPN provisioning agents, contractor access workflows, webhook-driven approvals.

## Variant phrasings
### Approval email instead of webhook
Parse structured fields only; free text is not a reliable source.

### Two contractors with the same name
Unique IDs are the only safe key; display names are decoration.

## Why it happens
Access grants are security-sensitive, but webhook parsing is often written casually. Loose parsing plus name matching is how the wrong person gets in.

## Edge cases
- Log the raw webhook payload for every grant; it is the audit record.
- Require a second signal, like the ticket ID, to corroborate the approval.
- Test with adversarial payloads: missing fields, extra fields, similar names.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_AKvU-1sV3zcD8dNu895VwQ