01 / The operating case
What changes in a real workflow?
An agent wrapper denies terminate_instance, but the agent can still call the cloud SDK through a shell tool with the same service credential.
- 01Authority origin
- 02Task and grant
- 03Current decision
- 04Observed outcome
02 / Decision contract
What the executor must check
Inventory tool calls, direct APIs, queue workers, retries, batch operations and emergency paths. Put the final check at the executor or protected API where it can stop the effect, then remove or constrain alternate credentials.
03 / Failure and evidence
What goes wrong, and what can be proven?
A team tests only the primary wrapper and declares the action protected while a second route uses the credential directly.
Keep route inventory, credential ownership, coverage tests, attempted alternate calls and downstream operation IDs. A denied wrapper call is not proof that no effect occurred elsewhere.
04 / Canonical scope
Why this reference stands alone
The PEP reference defines the enforcement component; this page owns systematic bypass discovery and route coverage testing.
Implementation review
Route coverage inventory
Path A: agent → guarded tool → cloud API. Path B: agent → shell → cloud SDK → same API. Path C: queued job → cloud API. The protection claim is true only when A, B and C carry an equivalent decision at the final mutation boundary.
Adversarial check
Give the runtime a direct SDK credential and bypass the wrapper. If termination succeeds without a matching decision, the enforcement point is incomplete.
Primary references