Skip to main content

Session Correlation (Lethal-Trifecta)

Some tool calls are harmless in isolation but dangerous in sequence. Reading a .env file is routine. Fetching a web page is routine. Running curl to an external host is routine. But an agent that does all three in one session — reads secrets, ingests untrusted external content, then reaches an outbound sink — is exhibiting the classic shape of a prompt-injection-driven exfiltration attack. Belay's session correlation layer watches for exactly this.

When this matters​

Single-rule matching (see the Rule Catalog) judges each tool call on its own. Correlation adds memory across a session so that a combination of individually-permitted actions can escalate to a higher verdict than any one of them would earn alone.

The arm → sink model​

Certain rules arm the session instead of blocking outright:

  • A secrets read (.env, AWS credentials, SSH keys, an environment dump) marks the session as holding sensitive data. In the catalog these rules carry an arms marker.
  • An untrusted ingest — fetching external web content via WebFetch — marks the session as having consumed content an attacker could control (the prompt-injection vector). This rule is allow on its own; it only taints.
  • An egress capability — a command that can send data to an outbound destination — is marked as a sink.

Correlation tracks these markers as the session progresses. An armed secret followed later by a matching sink is arm→sink correlation: the outbound call is re-weighted because the session is now known to be carrying secrets.

The lethal trifecta​

The strongest signal is the lethal trifecta — a single session that combines all three of:

  1. Private-data access — it has read secrets (armed).
  2. Untrusted content — it has ingested external, potentially attacker-controlled input.
  3. Exfiltration capability — it is now attempting an outbound sink.

When all three coincide, Belay raises a dedicated correlated finding (correlate.lethal_trifecta) and escalates the verdict for that session, even though each contributing action might have been individually allowed or merely ask-level.

note

This mirrors the widely-discussed "lethal trifecta" for AI agents: the combination of access to private data, exposure to untrusted content, and the ability to communicate externally is what turns a prompt injection into a data breach. Belay treats the co-occurrence as the risk, not any single leg.

How escalation works​

Correlation runs alongside single-rule matching and feeds into the same decision step. Because the engine resolves verdicts with Deny > Ask > Allow precedence and is fail-closed, a correlated escalation can turn a session's outbound call that would otherwise have been an ask into a hard stop, or surface an otherwise-quiet sequence for human Allow / Deny.

The correlation state is per-session and deterministic — no LLM is involved, and it stays inside the sub-100ms hot path.

Reading correlated findings​

Correlated verdicts appear in the audit log and in the desktop app's Activity and Live Feed views like any other decision, tagged with the correlation rule id so you can see why a sequence escalated rather than just that it did.