mcp-authority-boundary

That authorization at an agent's tool boundary is several properties that fail independently, and that mediation can hold while the binding between the authorized operation and the executed one does not.

Policy adequacy, meaning whether a policy expresses the authority its author intended. Two counterexamples covering that are retained unfixed. Effect verification is also not established by the shipped evidence: independent fixture read-back exists for two tools only, and the version-one ledger executed neither, so its stage-four checks were record consistency rather than observation of the world.

A Cedar-enforced Model Context Protocol server mediates six tools across 25 adversarial scenarios, writing every decision to a hash-chained ledger that an independently written replay verifier reads back. Four properties are separated and reported one by one: mediation, binding, policy adequacy, effect verification.

In version one, 66 of 66 tests passed, replay returned VERIFIED, a checked complete-mediation invariant held, and a write of 100,000 bytes executed under a 4,096-byte cap. The resolver measured the payload as a string and substituted zero bytes for a non-string; the executor coerced the same argument and wrote it. The repair binds execution to one validated immutable operation.

The Cedar policy engine, the Model Context Protocol SDK, Node, and the assumption that whoever launches the server chooses the session identity. Authentication is not provided and a hostile local actor who can spawn the process is not contained.

Complete mediation is a classical protection principle, and confused-deputy problems are long documented. The contribution here is the separation of four properties that are usually reported as one, on a working agent tool boundary, with the counterexamples kept rather than fixed.

npm install && ./run.sh

Findings drawn from this artifact are on the evidence ledger.