Tag
governance
40 entries, including 15 patterns.
- Pattern
Prompt-Independent Action Authorization
Treat a leaked prompt as reconnaissance, then prove the target service still rejects out-of-scope actions regardless of the words the model uses.
- Pattern
Source-Bound CI Attestation
Treat a passing PR check as an attestation from a designated runner about an exact revision, not as a green string any repository writer can supply.
The green check came from the wrong writer
A coding agent's PR can carry a passing status for a test it never ran when the merge gate trusts the check name but not its issuer.
- Pattern
Quarantine Unreviewed Installs
Let PR validation execute lifecycle hooks only in a worker whose credentials, network and output cannot become release authority without review.
The install step ran the pull request
An agent's code-review transcript may be clean while a dependency install executes repository-controlled code before the first test.
- Pattern
Effect-Bound Tool Route Gate
Authorize the effect at the service, regardless of which agent tool pipeline requested it.
The guardrail only wrapped one kind of tool
A per-tool safety check can be correct on the route it covers and irrelevant on the route that makes the same consequential change.
- Pattern
Resource-Bound Action Budget
Keep conversation policy for sequencing, but enforce cumulative limits in an atomic resource ledger across sessions and retries.
The budget reset with the conversation
Session-aware tool policy can remember a transfer, but a fresh conversation can forget it. Put durable limits at the resource that moves the money.
The hook went quiet; traffic did not
An inline AI policy can be configured and healthy-looking while requests pass uninspected. Measure enforcement coverage, not just denials.
- Pattern
Verdict Coverage Accounting
Join independent request counts to hook verdicts and configuration state so silent inspection gaps are observable and high-impact actions stay gated.
- Pattern
Pre-Dispatch Side-Effect Gate
Separate blocking run admission from a mandatory target-facing decision so a late tripwire cannot masquerade as prevention.
The guardrail finished after the send
A parallel input check can reject a run after its tool has already sent data. Put the security decision ahead of dispatch, not beside it.
The trace sampler erased the denial
A security decision cannot be audited from a trace that was never exported. Keep a narrow action ledger outside the sampled observability path.
- Pattern
Unsampled Action Receipt
Preserve gate decisions and target outcomes even when agent traces are sampled out or filtered.
- Pattern
Purpose-Bound Handoff Packets
Give each specialist only the authenticated fields its task requires, and test the input it actually receives.
The specialist inherited the whole case
A handoff can transfer far more than the task. Decide what the receiving agent may see before it receives history.
- Pattern
Adjudicated Feedback Promotion
Keep production complaints useful for finding failures without letting them decide what a secure agent should do.
- Pattern
Revocation-Aware Policy Gates
Make policy freshness an explicit precondition for privileged agent actions, and prove revocations take effect at every serving gate.
The revocation that never reached the gate
A centrally approved policy change does not revoke an agent's access until every consequential gate stops using the old revision.
When feedback becomes the test
A complaint can reveal a failure; it should not be able to rewrite the acceptance test that decides whether an agent is safe to release.
A registry spawn is not a catalog read
Accepting an MCP client registration that carries a command is process start, not browsing a tool list.
Non-empty is not authenticated
A non-empty Authorization header is not proof that a verifier ran or that the credential is valid.
Rejected is not blocked
A finishReason of tool_rejected does not prove the tool never ran.
A valid token is not your audience
A signature and expiry check does not prove the token was issued for this MCP server.
A session ID is not a credential
Conversation continuity tracks state. It does not prove who is calling.
Syntax is not intent
A well-formed tool call can still be the wrong action. Clear syntax is not a policy verdict.
Approved metadata is not a frozen contract
A tools/list snapshot from install time is not a lasting grant. After ordinary use, the same server can rewrite what the agent trusts.
Unset is not deny
When the webhook secret is absent, an if-secret check never runs. A warning is not a closed gate.
Memory without provenance is delayed authority
A write that can steer later tool calls is a control-plane event. Without provenance and audit, you cannot govern what fires next.
There is no single AI kill switch
Incident response needs independent controls over authority, connectivity and execution.
- Pattern
Three-Pillar Agent Containment
Pre-engineer independent response controls over an agent's authority, connectivity and execution.
- Pattern
External Agent Policy Enforcement
Keep authoritative policy outside the agent's control and require its decision at every consequential service boundary.
The agent edited its own policy
A repository policy file can guide an AI coding agent. It cannot constrain the agent when the same identity can rewrite or bypass it.
Cancelled is not contained
An A2A cancellation request does not prove that delegated work has stopped or that its credentials can no longer act.
- Pattern
Revocable Delegation Boundary
Bound cross-agent authority and verify that revocation reaches delegated execution.
A2A without a receipt
An authenticated agent call still needs a record of the policy that allowed it.
- Pattern
Skill Grant on the Hop
Enforce skill-level policy at the receiving agent, then bind a durable authorization receipt to the call before it runs.
A hook is not a security boundary
If the host is trusted, a contract can prove that an action stopped. It cannot contain a host that never asks.
Deny has to mean deny
Framework callbacks observe. A governance contract has to stop the action, even if the guard crashes.