Action Schema and Policy Reference

Provenance

public enum Provenance { Trusted, Tainted }

Join rule: any tainted input makes the result tainted. No operation converts tainted back to trusted. A function claiming to do so is a classifier, and chapter 4 covers why that is not a boundary.

public readonly record struct Tagged<T>(T Value, Provenance Origin);

Tool registration

public sealed record ToolPolicy(
    string ToolName,
    Capability RequiredCapability,
    bool Irreversible,
    bool ExternallyVisible,
    bool CrossesTrustBoundary,
    ProvenanceRule ArgumentRule);

A tool is consequential if any of Irreversible, ExternallyVisible or CrossesTrustBoundary is true. That is chapter 5's definition, mechanised.

Make all six fields required. An optional field acquires a default, the default is permissive, and a tool gets added on a Friday without anyone answering the question.

ProvenanceRule

The common configuration for an irreversible tool is EscalateTainted. DenyTainted where no reviewer has the context to judge.

Capabilities

public sealed record Capability(
    string Operation,
    string Resource,
    DateTimeOffset Expires,
    string TaskId);

public sealed record CapabilitySet(IReadOnlyList<Capability> Items)
{
    public bool Covers(Capability required) =>
        Items.Any(c => c.Operation == required.Operation
                    && c.Resource == required.Resource
                    && c.Expires > DateTimeOffset.UtcNow);
}

Capabilities are derived from the authenticated user's authority at task start, never from a service account, and never widened by anything the model says. Task intent is declared in code, not inferred.

Proposals and verdicts

public sealed record Proposal(
    string ToolName,
    IReadOnlyList<Argument> Arguments,
    CapabilitySet Held);

public sealed record Argument(string Name, object? Value, Provenance Origin);

public enum Outcome { Allow, Deny, Escalate }

public sealed record Verdict(
    Outcome Outcome,
    string DeniedBy,
    string ReasonForModel,
    string ReasonForAudit);

Evaluation order

Fixed, and the order matters.

public Verdict Evaluate(Proposal p)
{
    if (!_policies.TryGetValue(p.ToolName, out var rule))
        return Verdict.Deny("default-deny", "That action is not available.");

    if (!p.Held.Covers(rule.RequiredCapability))
        return Verdict.Deny("capability", "That action is not available.");

    if (rule.Irreversible && p.Arguments.Any(a => a.Origin is Provenance.Tainted))
        return Verdict.Escalate("tainted-irreversible", "This needs confirmation.");

    return Verdict.Allow();
}

1. Existence. A tool with no policy is denied. Default-deny is what makes the design survive a team that adds tools faster than policies.
2. Authority. Capability check. Cheap and it fails most misconfigurations.
3. Provenance. The check no conventional authorisation system can make.

Fail closed. If the policy store cannot be reached, deny. An agent that stops working is an incident; an agent that keeps working is a breach discovered later by someone else.

Egress policy

public bool IsAllowed(string url, Provenance origin)
{
    if (!Uri.TryCreate(url, UriKind.Absolute, out var uri)) return false;
    if (uri.Scheme is not ("https" or "mailto")) return false;
    if (!_allowedHosts.Contains(uri.Host)) return false;
    if (origin is Provenance.Tainted && uri.Query.Length > 0) return false;
    return true;
}

Images in rendered output are stripped unconditionally. Where a product needs them, fetch server-side after checking the URL, and serve from your own host.

Audit record

public sealed record GateRecord(
    DateTimeOffset At,
    string SessionId,
    string TaskId,
    string ToolName,
    IReadOnlyList<(string Name, Provenance Origin, string SourceRef)> Arguments,
    Outcome Outcome,
    string DeniedBy,
    string ReasonForAudit);

Argument origins are recorded. Argument values are not. Logging values recreates the exposure chapters 6 and 10 exist to prevent, and makes the log store the thing an attacker wanted.

SourceRef points at the document, ticket or memory record that produced each tainted argument. It is what turns chapter 17's blast-radius assessment into a query.

Record denied and escalated proposals as well as allowed ones. The denials are the pattern, and a system that never reads its denial log has discarded its only signal about how often it is being probed.