# Threat model

## Security objective

Given a principal-signed manifest for one run, no effect routed through a
ScopeWrit adapter may execute unless the exact proposed action is inside the
manifest's action, resource, method, attribute, count, time, run, and adapter
boundaries.

Reachability, natural-language plausibility, and the agent's own interpretation
never add authority.

## Trusted computing base

- the principal signing key and its issuance process;
- the operator-configured public-key trust store;
- the ScopeWrit engine, SQLite state, issuer key, and recorder;
- each adapter process and the code that withholds its raw client from the
  agent;
- the host OS and filesystem permissions underneath those components.

Compromise of any item above is outside the current reference guarantee.

## Protected effects

The reference implementation can admit or reject:

- HTTP requests;
- MCP tool calls;
- subprocess execution;
- browser navigation or mutation callbacks;
- cloud API callbacks;
- credential release callbacks;
- package-manager callbacks;
- publication or messaging callbacks.

The effect is protected only if the unguarded capability is not also available
to the agent.

## Adversaries considered

- a model that infers permission from access or relatedness;
- prompt injection that asks the agent to reinterpret scope;
- a caller that tampers with a signed manifest;
- signer-key substitution;
- replay of a run nonce, approval, or action ticket;
- moving a ticket to another action, resource, run, or adapter;
- default-allow mistakes and conflicting allow/deny rules;
- URL userinfo, encoded separator/dot, wildcard, default-port, and path-prefix
  ambiguity;
- loopback, private, link-local, reserved, and mixed DNS results;
- flight-recorder entry modification, reordering, and prefix truncation when a
  signed audit packet is available.

## Invariants

1. A public key is trusted only because the operator configured it.
2. A manifest nonce and run ID are consumed once.
3. Explicit deny rules are evaluated before allow rules.
4. No matching allow rule means `DENY`.
5. Private/reserved destinations require both an explicit private-network flag
   and, when supplied, matching resolved CIDRs.
6. Uncertainty can only reduce authority by producing `PAUSE`.
7. An approval is signed, exact-proposal-bound, expiring, and consume-once.
8. An action ticket is signed, exact-proposal-bound, expiring, adapter-bound,
   and consume-once.
9. The adapter consumes the ticket before performing the effect.
10. Every decision and execution outcome extends the recorder hash chain.

## Known exclusions

- An agent with raw sockets, a raw SDK client, a second shell, or another
  credential path can bypass an application-level adapter.
- The HTTP adapter now connects to its checked literal IP while verifying the
  original TLS hostname. An injected custom transport is a trusted component;
  no guarantee applies to raw network access outside this adapter.
- Redirects are disabled rather than recursively authorized.
- The recorder is hash-chained and signed at closure, not an append-only
  off-host transparency service. An attacker with the issuer key and storage
  control can rewrite history.
- Cooperating local processes serialize recorder writes using OS locks.
  Shared-network-filesystem lock semantics, distributed writers, and off-host
  anchoring are outside the validated deployment.
- Scope-uncertainty detection sees only text voluntarily supplied to the action
  proposal. It does not inspect hidden chain-of-thought.
- The synthetic benchmark tests enforcement against a deterministic control.
  It does not establish how often real models become confused about reality or
  scope.
- ScopeWrit does not validate whether the signed principal intended the policy,
  whether an allowed action is wise, or whether the underlying tool is secure.

## Production composition

A production deployment should:

1. run agents under an OS/container identity with no direct effectful
   capability;
2. make ScopeWrit adapters the only network, process, browser, credential, and
   cloud paths;
3. store principal and issuer keys in separate KMS/HSM trust domains;
4. enforce adapter-only egress at the network layer;
5. keep recorder files on a local filesystem and anchor ledger heads off-host;
6. monitor revocation state independently of model context;
7. test adapter bypass, confused deputy, and policy substitution in a hostile
   isolated range.
