You confirmed a read-plus-write path in an assistant where every capability passed review — whom do you file it against and how do you defend its severity?

### The judgement, not the mechanism By this point the technical facts are settled: a read reaches private context, a write reaches the network, and they coexist in one session. What a lead owns is not the discovery but the *disposition* — where the finding goes and how firmly its severity holds — under an organisational reflex that wants to close it. That reflex is specific and reasonable-sounding: every capability passed its own review, so no reviewer erred and no tool is defective; therefore, the argument runs, there is nothing to fix and no one to assign. Answering it is the principal-level skill. ### Whom it belongs to The finding does not belong to the reader's author or the fetch's author, because each did exactly what their review approved. It belongs to the party who *composed* them — whoever configured the deployment to enable both capabilities for one assistant. That act created the set, and the set is the vulnerability. This is the practical force of 'the pair is assembled at deployment by someone who is not reviewing anything': the only actor who ever had the whole picture is the composition owner, so they are the only place accountability can rest. In many organisations that owner is a platform or deployment configuration rather than a person, which is itself part of the finding — the risk was created by a step that no process treated as a review. Naming that owner explicitly is often the hardest and most valuable line in the report. ### Defending severity Severity is argued on the *composed* capability. A private-context read feeding a process-leaving write is, by construction, a path for attacker-influenced content to move private data outward — the impact of exfiltration, not of either tool. The strongest rhetorical trap is to let severity be discounted because 'each part is benign'; the correct response is that individual benignity is the *definition* of the class, not a reason to downgrade. You anchor severity to what the pair can do, and you resist scoring it as two low findings, because two low findings summed is precisely the composition the review missed. (Keep this distinct from a privilege-escalation argument about production reach: here the claim is about a diffused-ownership composition, not about whether any privilege was crossed.) ### The assurance you can honestly claim A principal also owns the confidence attached to the number. Because the pair was established by probing a probabilistic system, the report must carry its own reliability: how many sessions and probes it took, how much of the conclusion came from an observed off-process effect versus inference from reply wording, and how often the pair reproduces. This is where over- and under-claiming both do damage. A pair seen once, on one deployment, with signal mostly inferred from bland replies, is a *lead* — reporting it as a confirmed critical invites a failed re-test that discredits the whole finding. A pair that reproduces across sessions with a controlled observable is a severity you can defend under challenge. The honest artefact states which it is, and prices the discovery: what the estimate cost and what it is worth to whoever reads it. ### Bug or design limit Finally, a lead may have to rule on whether this is a *defect* to be fixed or a *design limit* of allowing composable capabilities at all. If the platform's whole value is letting operators wire arbitrary tools together, then read-plus-write pairs are an emergent property of the design, and the finding is really a statement about the deployment model — which changes who must act and how. Deciding that, and communicating it without either crying wolf or waving the risk away, is the judgement under organisational constraint that makes this a principal question rather than a harder senior one. ### What good looks like A strong answer assigns the finding to the composition owner, defends severity on the composed impact while refusing the 'each part is fine' discount, states the reproduction rate and probe cost plainly, and takes a position on bug-versus-design-limit — all without overclaiming a reliability the probing did not earn.