Findings · Agent control

A write of 100,000 bytes executed under a policy that capped writes at 4,096 bytes, while 66 of 66 tests passed, an independent replay verifier returned VERIFIED, and a checked complete-mediation invariant held.

Evidence

An agent asked to write a file. The policy allowed writes up to 4,096 bytes. The write that ran was 100,000 bytes.

Every signal that existed to catch this reported success. The test suite passed. An independently written replay verifier read the decision ledger back and returned VERIFIED. An invariant checking that no mediated tool executes without an authorization decision held, and it held truthfully: the decision really was made.

The two halves read the same input differently. The component that resolved the request for the policy engine measured the payload as a string, and substituted zero bytes when it was not one. The component that executed the request coerced the same argument and wrote it. So the engine authorized an operation that did not describe what was about to happen, and every downstream check confirmed that the authorized operation had been authorized.

The repair binds execution to one validated operation. Two counterexamples are kept unfixed in the repository, because they are about whether the policy says what its author intended, which is a different property and is not established here. A released claim about effect verification was also corrected downward on 14 August 2026, and a test now fails the build if that combination recurs.

Sample. One Cedar-enforced tool boundary, six mediated tools, 25 adversarial scenarios, one hash-chained decision ledger. A constructed system, not a population.

Boundary

One defect in one server built for this study, not a measurement of deployed systems and not a claim about how often authorization layers and executors diverge. Mediation held throughout; what failed was the binding between the authorized operation and the executed one. Policy adequacy is separately not established, and two counterexamples covering it are retained unfixed.

Independent reproduction. None known.

Reproduction

npm install && ./run.sh

Toolchain: TypeScript, Node, the Cedar policy engine, the Model Context Protocol SDK; no network
Expected output: The version-one ledger records the oversized write as executed under the 4,096-byte policy; the replay verifier reports VERIFIED for the same ledger
Claim stated at: repowazdogz-droid/mcp-authority-boundary · README.md, sections Abstract and Four properties, which fail separately
Verified at: repowazdogz-droid/mcp-authority-boundary@03854ddc (2026-08-17)

This pass. Re-verified this pass by source read at commit 03854ddc; the run script and test suite are in the repository and were not re-executed in this pass.

Artifact: repowazdogz-droid/mcp-authority-boundary