01 / The operating case
What changes in a real workflow?
A gateway allows delete_file for a test folder; the server later receives the same call for a production folder through a direct connection.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
Normalize and evaluate the requested path at the server or protected filesystem boundary, and ensure every route receives an equivalent check.
03 / Failure and evidence
What goes wrong, and what can be proven?
Policy exists in a gateway but the underlying executor accepts calls from another path.
Compare gateway decisions, server invocation IDs and filesystem changes to detect bypass.
04 / Canonical scope
Why this reference stands alone
Gateway security owns topology; this page owns the per-call enforcement contract.
Protocol or attack trace
Per-call binding
Gateway allows delete_file(path=/test/a); server receives delete_file(path=/prod/a) through another connection.
Executor denies changed path and any route with no matching decision digest.
Primary references