Confirmation Gates
Prepare a reviewable operation, check authorization for its concrete consequences, then execute and verify its state.
Safety & trust
Prompt Injection Defense
Keep externally supplied instructions inside the data trust boundary.
Sensitive Data Redaction
Exclude sensitive values from reports and generated fixtures.
Read-Only Boundary
Declare a read-only operating scope before investigation.
Rescue-Tag-Before-Destructive-Operation
Create and verify a recovery artifact before destructive state changes.
Tiered Permission Model (RED/DEFER/GREEN)
Classify actions into permitted, approval-required and forbidden tool policies.
Data Classification Matrix (4-Level)
Map data classes to approved destinations and allowed transformations.
Whole-Payload Skill Review
Review the complete shipped skill payload before trusting its loaded entrypoint.
Orchestrator-Only (No Direct Data)
Delegate raw data access to bounded roles and keep the orchestrator focused on coordination and minimal results.
Scoped Authorization and Action Risk
Assess effect reach and recoverability while honoring the actual authorization scope.
Tool-Constraint Boundaries
Enforce capability boundaries across every available execution route.
Cross-Service Credential-Routing Detection
Check whether credential flow stays within its authorized service and destination.
Untrusted-Content-as-Markup Escaping
Encode untrusted text for the exact output context that receives it.
Keep an undo ledger for file operations
Preserve originals or record reversible source-to-destination moves before reorganizing files.
Bind actions to the selected tenant
Select the intended organization explicitly instead of accepting a first-account default.
Cache keys encode response-changing inputs
Derive a cache key from every input that affects the visible response.
Resolve confinement and ownership before destruction
A well-formed derived path is a candidate target, not permission to delete it.
Exemption authority outside the constrained unit
A unit under validation cannot grant itself an exemption from that validation.
Pass review artifacts through inert input channels
Preserve artifact text as data when invoking an external reviewer.
Make request-traceable surgical edits
Bound authorized edits to the requested behavior and only clean up orphans created by those edits.
Provenance for precise-looking mock content
Require a source or visible mock status for factual-looking metrics and specifications.
Check privacy and evidence usefulness separately
Verify that an export is scrubbed and independently verify that its remaining evidence still supports its claims.
Preserve linkage with stable redaction placeholders
Use consistent substitutions across an export while retaining safe identity and evidence structure.
Audience, Participation and Delivery Separation
Keep audience trust, permission to participate and permission to deliver as separate checks.
Exact-Draft Epoch-Bound Approval
Bind approval to the exact draft bytes, destination and current revision so stale decisions cannot release rewritten text.
Revoke the prior grant when narrowing access
Narrow an existing agent grant without leaving its old broader credential usable.