GATE012: Administrative capability exposed

The agent can change permissions, policy, ownership or production configuration.

Name
Severity
Type
High
Description
Default severity. An individual finding may be reported higher or lower when the surrounding configuration justifies it.
Name
Capabilities
Type
admin
Description
Capability classes this rule reasons about.
Name
Explain locally
Type
gate explain GATE012
Description
The same text, in your terminal, with no network access.

What Gate detected

Gate classified a tool or grant as carrying the admin capability, modifying IAM policy, repository or organisation settings, branch protection, webhooks, deploy keys, or account ownership.

Administrative capability is the capability that lets an agent change its own limits. Everything else in a scan describes what the agent can do today; admin describes what it can decide to be able to do tomorrow. An agent that can edit an IAM policy has, in effect, every permission that policy can grant.

It is also the capability most likely to disable your other controls: branch protection, required reviews, audit webhooks and secret scanning are all administrative settings.

Example

This is the shape of configuration that triggers the rule.

// github.update_repository -> write, admin
// aws.put_role_policy      -> admin, write

Remediation

Separate administration from operation. Give the agent a credential that can do its job and cannot change permissions, and perform administrative changes through a reviewed, human-approved path such as infrastructure-as-code.

Suppressing this rule

If this finding is acceptable in your repository, record why alongside the suppression:

gate.config.ts

export default defineConfig({
  ignore: [
    {
      rule: 'GATE012',
      reason: 'Why this is acceptable here',
    },
  ],
})

Gate refuses to apply an ignore entry with no reason. The reason is the only thing that will tell the next person whether the suppression is still true.