{
  "standard": "OARS",
  "name": "Open App Risk Standard",
  "specVersion": "0.1.0-draft",
  "status": "Draft",
  "license": "CC-BY-4.0",
  "homepage": "https://citadel.ms",
  "repository": "https://github.com/citadelms/OARS",
  "authors": [
    {
      "name": "Khurram Chaudhary",
      "role": "Founding Author"
    }
  ],
  "attribution": "Derived from the Graph Consent Risk Framework by Khurram Chaudhary. Licensed CC BY 4.0 — attribution required.",
  "generatedAt": "2026-07-26T01:12:26.340Z",
  "combinations": [
    {
      "id": "offline-access-plus-files-write",
      "permissions": [
        "offline_access",
        "Files.ReadWrite.All"
      ],
      "severity": "pairing",
      "rationale": "Long-lived refresh tokens combined with tenant-wide file write turns a one-time consent into persistent read-write access to all content. Access survives password resets and is easily missed in review."
    },
    {
      "id": "offline-access-plus-mail-read",
      "permissions": [
        "offline_access",
        "Mail.Read"
      ],
      "severity": "pairing",
      "rationale": "Persistent mailbox access without re-authentication. A common pattern in business email compromise, where the token outlives the incident response."
    },
    {
      "id": "mail-send-plus-mail-read",
      "permissions": [
        "Mail.Send",
        "Mail.Read"
      ],
      "severity": "pairing",
      "rationale": "Reading and sending as the user together enable convincing internal phishing: the app can study real threads and reply in context."
    },
    {
      "id": "approle-assignment-plus-app-write",
      "permissions": [
        "AppRoleAssignment.ReadWrite.All",
        "Application.ReadWrite.All"
      ],
      "severity": "escalation",
      "rationale": "The app can grant itself additional permissions and consent to them. This is a complete privilege-escalation path to global compromise and should be treated as equivalent to directory takeover."
    },
    {
      "id": "role-management-plus-directory-write",
      "permissions": [
        "RoleManagement.ReadWrite.Directory",
        "Directory.ReadWrite.All"
      ],
      "severity": "escalation",
      "rationale": "Directory write combined with role assignment lets the app create an identity and elevate it to a privileged role."
    },
    {
      "id": "app-write-plus-credential-management",
      "permissions": [
        "Application.ReadWrite.All",
        "Application.ReadWrite.OwnedBy"
      ],
      "severity": "escalation",
      "rationale": "Ability to add credentials to existing service principals allows impersonation of any application in the tenant, including highly privileged ones."
    },
    {
      "id": "policy-write-plus-directory-read",
      "permissions": [
        "Policy.ReadWrite.ConditionalAccess",
        "Directory.Read.All"
      ],
      "severity": "escalation",
      "rationale": "Enumerating the directory while being able to weaken conditional access allows targeted removal of protections before an attack."
    },
    {
      "id": "sites-full-control-plus-offline",
      "permissions": [
        "Sites.FullControl.All",
        "offline_access"
      ],
      "severity": "pairing",
      "rationale": "Persistent full control of all SharePoint sites, including the ability to alter permissions on content the app does not own."
    },
    {
      "id": "user-write-plus-group-write",
      "permissions": [
        "User.ReadWrite.All",
        "Group.ReadWrite.All"
      ],
      "severity": "pairing",
      "rationale": "Creating users and adding them to groups can grant access indirectly, bypassing controls that watch role assignment but not group membership."
    }
  ]
}