OBSERVED
Finding · authorise
An agent was limited to 4 KB. It wrote 100 KB. Every test passed, an independent replay verifier said VERIFIED, and a checked invariant held.
- The system said
- Limited to 4 KB. 66 tests passed. Replay: VERIFIED.
- The evidence showed
- A 100,000-byte write executed under the 4,096-byte cap. Mediation held; the binding between the authorised operation and the executed one did not.
§ 1
The record
FINDING · authorized-limit-and-executed-write-disagreedauthorise · faithfulness
An agent was limited to 4 KB. It wrote 100 KB. Every test passed, an independent replay verifier said VERIFIED, and a checked invariant held.
- Claim
- A write of 100,000 bytes executed under a policy that capped writes at 4,096 bytes, while 66 of 66 tests passed, an independent replay verifier returned VERIFIED, and a checked complete-mediation invariant held.
- Status
- OBSERVED Witnessed in one instance. No claim about how often.
- Question
- Authorised is not executed
- Subject
- A Cedar-mediated MCP tool server built for the study (authored). built for the study
- Frame
- One server, six tools, 25 adversarial scenarios; the write cap is a policy constant.
- Method
- Every decision is written to a hash-chained ledger that an independently written replay verifier reads back; four properties (mediation, binding, policy adequacy, effect verification) are reported separately.
- Oracle
- The bytes actually written to the fixture, read back independently of the executor.
- Negative control
- Present The repair is re-attacked with a falsification sweep; the version-one audit is preserved so the failing state can be re-run.
- Denominator
- 66 of 66 tests in version one; one write of 100,000 bytes against a 4,096-byte cap.
- Limitation
- One defect in one server built for this study, not a measurement of deployed systems and not a claim about how often authorization layers and executors diverge. Mediation held throughout; what failed was the binding between the authorized operation and the executed one. Policy adequacy is separately not established, and two counterexamples covering it are retained unfixed.
- Source
- repowazdogz-droid/mcp-authority-boundary @ 03854ddc
- Reproduce
npm install && ./run.sh
- Independent reproduction
- None known.
§ 2
Where this sits
This finding answers Authorised is not executed and supports the AUTHORISE stage of the operating method. It is an instance of the faithfulness mechanism.