{ "schemaVersion": "cg-agent-delegation-boundary-fixture-0.1.0", "id": "CG-FIXTURE-AGENT-DELEGATION-BOUNDARY-0.1.0", "benchmarkId": "CG-BENCHMARK-AGENT-DELEGATION-BOUNDARY-0.1.0", "version": "0.1.0", "authorization": "Publisher-created inert fixtures using a disclosed synthetic key, no customer data, and no external agent or network execution.", "syntheticKeyHex": "4444444444444444444444444444444444444444444444444444444444444444", "syntheticKeyNotice": "This public deterministic test key is not a production secret and must never be used outside the fixture.", "times": { "rootIssuedAt": "2026-07-29T00:00:00.000Z", "rootExpiresAt": "2026-07-29T00:10:00.000Z", "childIssuedAt": "2026-07-29T00:01:00.000Z", "childExpiresAt": "2026-07-29T00:08:00.000Z", "verifyAt": "2026-07-29T00:02:00.000Z" }, "actors": { "issuer": "security.owner", "root": "agent.root", "child": "agent.reviewer", "grandchild": "agent.specialist" }, "taskId": "task.delegation-boundary-benchmark", "rootSessionId": "CGS-DELEGATION-BOUNDARY-0001", "policy": { "defaultDecision": "block", "policyId": "CGPOL-LOCAL-AI-AGENT-BASELINE", "rules": [ { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [], "dataClassifications": [ "confidential", "restricted" ], "effect": "block", "enforceability": "enforced", "environments": [], "id": "CGP-SECRET-PATH-DENY", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "file.read", "file.write" ], "pathGlobs": [ "**/*.key", "**/*.pem", "**/*service-account*.json", "**/.env*", ".env*" ], "priority": 1000, "reason": "Secret-bearing paths require an explicit human-approved exception.", "requireTaskId": false, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [ "curl", "wget" ], "contextTrust": [], "dataClassifications": [], "effect": "block", "enforceability": "enforced", "environments": [], "id": "CGP-UNREVIEWED-TRANSFER-DENY", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "command.execute" ], "pathGlobs": [], "priority": 950, "reason": "Unreviewed transfer commands can move repository data outside the approved boundary.", "requireTaskId": false, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [], "dataClassifications": [], "effect": "require_approval", "enforceability": "enforced", "environments": [], "id": "CGP-PROTECTED-WRITE-APPROVAL", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "file.write" ], "pathGlobs": [ ".github/workflows/**", "db/migrations/**", "infra/**" ], "priority": 900, "reason": "Workflow, migration, and infrastructure changes require human review.", "requireTaskId": true, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [], "dataClassifications": [ "confidential" ], "effect": "redact", "enforceability": "enforced", "environments": [], "id": "CGP-RESTRICTED-DATA-REDACT", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "file.read" ], "pathGlobs": [ "docs/private/**" ], "priority": 800, "reason": "Confidential documentation must be redacted before it is returned through the gateway.", "requireTaskId": false, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [ "unknown", "untrusted" ], "dataClassifications": [], "effect": "simulate", "enforceability": "enforced", "environments": [], "id": "CGP-UNTRUSTED-MCP-SIMULATE", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "mcp.tool.invoke" ], "pathGlobs": [], "priority": 700, "reason": "Unknown or untrusted MCP behavior should be simulated before live execution.", "requireTaskId": false, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [], "dataClassifications": [], "effect": "require_approval", "enforceability": "advisory", "environments": [], "id": "CGP-AGENT-HANDOFF-APPROVAL", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "agent.handoff" ], "pathGlobs": [], "priority": 600, "reason": "Agent handoffs require an attributable task and human approval.", "requireTaskId": true, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [], "dataClassifications": [], "effect": "require_approval", "enforceability": "enforced", "environments": [], "id": "CGP-APPROVED-NETWORK-HEAD", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [ "*.googleapis.com", "api.anthropic.com", "api.openai.com" ], "networkMethods": [ "HEAD" ], "operations": [ "network.connect" ], "pathGlobs": [], "priority": 500, "reason": "Metadata-only HTTPS checks to approved hosts require a one-time capability lease.", "requireTaskId": true, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [ "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945" ], "commandExecutables": [ "true" ], "contextTrust": [], "dataClassifications": [], "effect": "allow", "enforceability": "enforced", "environments": [], "id": "CGP-SAFE-COMMAND-ALLOW", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "command.execute" ], "pathGlobs": [], "priority": 150, "reason": "The no-op true command with no arguments is allowed for gateway health checks.", "requireTaskId": false, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [ "reviewed", "trusted" ], "dataClassifications": [ "internal", "public" ], "effect": "allow", "enforceability": "enforced", "environments": [], "id": "CGP-SAFE-READ-ALLOW", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "file.read" ], "pathGlobs": [ "docs/**", "src/**" ], "priority": 100, "reason": "Reviewed source and documentation reads are within the declared baseline.", "requireTaskId": false, "targetAgentIds": [], "toolIds": [] } ], "schemaVersion": "cg-policy-0.1.0", "version": "0.1.0" }, "alternatePolicy": { "defaultDecision": "block", "policyId": "CGPOL-DELEGATION-BOUNDARY-ALTERNATE", "rules": [ { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [], "dataClassifications": [ "confidential", "restricted" ], "effect": "block", "enforceability": "enforced", "environments": [], "id": "CGP-SECRET-PATH-DENY", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "file.read", "file.write" ], "pathGlobs": [ "**/*.key", "**/*.pem", "**/*service-account*.json", "**/.env*", ".env*" ], "priority": 1000, "reason": "Secret-bearing paths require an explicit human-approved exception.", "requireTaskId": false, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [ "curl", "wget" ], "contextTrust": [], "dataClassifications": [], "effect": "block", "enforceability": "enforced", "environments": [], "id": "CGP-UNREVIEWED-TRANSFER-DENY", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "command.execute" ], "pathGlobs": [], "priority": 950, "reason": "Unreviewed transfer commands can move repository data outside the approved boundary.", "requireTaskId": false, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [], "dataClassifications": [], "effect": "require_approval", "enforceability": "enforced", "environments": [], "id": "CGP-PROTECTED-WRITE-APPROVAL", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "file.write" ], "pathGlobs": [ ".github/workflows/**", "db/migrations/**", "infra/**" ], "priority": 900, "reason": "Workflow, migration, and infrastructure changes require human review.", "requireTaskId": true, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [], "dataClassifications": [ "confidential" ], "effect": "redact", "enforceability": "enforced", "environments": [], "id": "CGP-RESTRICTED-DATA-REDACT", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "file.read" ], "pathGlobs": [ "docs/private/**" ], "priority": 800, "reason": "Confidential documentation must be redacted before it is returned through the gateway.", "requireTaskId": false, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [ "unknown", "untrusted" ], "dataClassifications": [], "effect": "simulate", "enforceability": "enforced", "environments": [], "id": "CGP-UNTRUSTED-MCP-SIMULATE", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "mcp.tool.invoke" ], "pathGlobs": [], "priority": 700, "reason": "Unknown or untrusted MCP behavior should be simulated before live execution.", "requireTaskId": false, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [], "dataClassifications": [], "effect": "require_approval", "enforceability": "advisory", "environments": [], "id": "CGP-AGENT-HANDOFF-APPROVAL", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "agent.handoff" ], "pathGlobs": [], "priority": 600, "reason": "Agent handoffs require an attributable task and human approval.", "requireTaskId": true, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [], "dataClassifications": [], "effect": "require_approval", "enforceability": "enforced", "environments": [], "id": "CGP-APPROVED-NETWORK-HEAD", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [ "*.googleapis.com", "api.anthropic.com", "api.openai.com" ], "networkMethods": [ "HEAD" ], "operations": [ "network.connect" ], "pathGlobs": [], "priority": 500, "reason": "Metadata-only HTTPS checks to approved hosts require a one-time capability lease.", "requireTaskId": true, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [ "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945" ], "commandExecutables": [ "true" ], "contextTrust": [], "dataClassifications": [], "effect": "allow", "enforceability": "enforced", "environments": [], "id": "CGP-SAFE-COMMAND-ALLOW", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "command.execute" ], "pathGlobs": [], "priority": 150, "reason": "The no-op true command with no arguments is allowed for gateway health checks.", "requireTaskId": false, "targetAgentIds": [], "toolIds": [] }, { "actorIds": [], "commandArgumentDigests": [], "commandExecutables": [], "contextTrust": [ "reviewed", "trusted" ], "dataClassifications": [ "internal", "public" ], "effect": "allow", "enforceability": "enforced", "environments": [], "id": "CGP-SAFE-READ-ALLOW", "mcpServers": [], "mcpTools": [], "mcpArgumentDigests": [], "networkHosts": [], "networkMethods": [], "operations": [ "file.read" ], "pathGlobs": [ "docs/**", "src/**" ], "priority": 100, "reason": "Reviewed source and documentation reads are within the declared baseline.", "requireTaskId": false, "targetAgentIds": [], "toolIds": [] } ], "schemaVersion": "cg-policy-0.1.0", "version": "0.1.0" }, "requests": { "rootRead": { "actorId": "agent.root", "contextTrust": "reviewed", "dataClassification": "internal", "environment": "local", "evidenceRefs": [ "CGE-DELEGATION-ROOT-READ-0001" ], "operation": "file.read", "requestId": "CGR-DELEGATION-ROOT-READ-0001", "resource": { "path": "src/index.ts" }, "schemaVersion": "cg-policy-request-0.1.0", "taskId": "task.delegation-boundary-benchmark", "toolId": "tool.delegation-boundary-benchmark" }, "childRead": { "actorId": "agent.reviewer", "contextTrust": "reviewed", "dataClassification": "internal", "environment": "local", "evidenceRefs": [ "CGE-DELEGATION-CHILD-READ-0001" ], "operation": "file.read", "requestId": "CGR-DELEGATION-CHILD-READ-0001", "resource": { "path": "src/index.ts" }, "schemaVersion": "cg-policy-request-0.1.0", "taskId": "task.delegation-boundary-benchmark", "toolId": "tool.delegation-boundary-benchmark" }, "outsideRead": { "actorId": "agent.reviewer", "contextTrust": "reviewed", "dataClassification": "internal", "environment": "local", "evidenceRefs": [ "CGE-DELEGATION-OUTSIDE-READ-0001" ], "operation": "file.read", "requestId": "CGR-DELEGATION-OUTSIDE-READ-0001", "resource": { "path": "src/other.ts" }, "schemaVersion": "cg-policy-request-0.1.0", "taskId": "task.delegation-boundary-benchmark", "toolId": "tool.delegation-boundary-benchmark" }, "outsideNetwork": { "actorId": "agent.reviewer", "contextTrust": "reviewed", "dataClassification": "unknown", "environment": "local", "evidenceRefs": [ "CGE-DELEGATION-OUTSIDE-NETWORK-0001" ], "operation": "network.connect", "requestId": "CGR-DELEGATION-OUTSIDE-NETWORK-0001", "resource": { "host": "api.openai.com", "method": "HEAD", "pathDigestSha256": "69e036560509efa96e6982dc3e6fd2b82c3d4accc156acfe008f90324731879f" }, "schemaVersion": "cg-policy-request-0.1.0", "taskId": "task.delegation-boundary-benchmark", "toolId": "tool.delegation-boundary-benchmark" } }, "envelopes": { "root": { "capabilityDigestsSha256": [ "3bad7829afc38eec0edb2b6352758e7453d286277a66cb325a4d7a5ed412e58e" ], "claimBoundary": "CapitalGuard authenticates and attenuates authority represented by delegation envelopes that are issued, derived, and consumed through this firewall. It does not start a target agent or control operations that bypass the firewall and Agent Action Gateway.", "delegationId": "CGD-BOUNDARY-ROOT-STATIC-0001", "depth": 0, "expiresAt": "2026-07-29T00:10:00.000Z", "issuedAt": "2026-07-29T00:00:00.000Z", "issuerAgentId": "security.owner", "maxDepth": 3, "maxUses": 1, "nonce": "101010101010101010101010101010101010101010101010", "parentDelegationDigestSha256": null, "policyDigestSha256": "69c63c44fdeeed1fc20e16906c97e099c8ba4a5ba19551ee8f970ba9853ae38b", "rootSessionId": "CGS-DELEGATION-BOUNDARY-0001", "schemaVersion": "cg-delegation-envelope-0.1.0", "subjectAgentId": "agent.root", "taskDigestSha256": "c3f12f4cb167ba9527479b9fb3e5ae380cb60d183644d3feaf6771175b8f9e3e", "signatureAlgorithm": "hmac-sha256", "signatureSha256": "6c33c029d84d8f047f52834f0d9a9671d84e7c5e2b5a11ab41417f58db997701" }, "child": { "capabilityDigestsSha256": [ "3bad7829afc38eec0edb2b6352758e7453d286277a66cb325a4d7a5ed412e58e" ], "claimBoundary": "CapitalGuard authenticates and attenuates authority represented by delegation envelopes that are issued, derived, and consumed through this firewall. It does not start a target agent or control operations that bypass the firewall and Agent Action Gateway.", "delegationId": "CGD-BOUNDARY-CHILD-STATIC-0001", "depth": 1, "expiresAt": "2026-07-29T00:08:00.000Z", "issuedAt": "2026-07-29T00:01:00.000Z", "issuerAgentId": "agent.root", "maxDepth": 3, "maxUses": 1, "nonce": "111111111111111111111111111111111111111111111111", "parentDelegationDigestSha256": "d915e7dbd7399ce98ad066f6df1fb75c001717d446aa4ccade559444071d8679", "policyDigestSha256": "69c63c44fdeeed1fc20e16906c97e099c8ba4a5ba19551ee8f970ba9853ae38b", "rootSessionId": "CGS-DELEGATION-BOUNDARY-0001", "schemaVersion": "cg-delegation-envelope-0.1.0", "subjectAgentId": "agent.reviewer", "taskDigestSha256": "c3f12f4cb167ba9527479b9fb3e5ae380cb60d183644d3feaf6771175b8f9e3e", "signatureAlgorithm": "hmac-sha256", "signatureSha256": "a5112ee44d765e899dc32e2746956c9b4e7a2b5fece25067d8c1637a96324d4c" }, "otherRoot": { "capabilityDigestsSha256": [ "3bad7829afc38eec0edb2b6352758e7453d286277a66cb325a4d7a5ed412e58e" ], "claimBoundary": "CapitalGuard authenticates and attenuates authority represented by delegation envelopes that are issued, derived, and consumed through this firewall. It does not start a target agent or control operations that bypass the firewall and Agent Action Gateway.", "delegationId": "CGD-BOUNDARY-ROOT-OTHER-00001", "depth": 0, "expiresAt": "2026-07-29T00:10:00.000Z", "issuedAt": "2026-07-29T00:00:00.000Z", "issuerAgentId": "security.owner", "maxDepth": 3, "maxUses": 1, "nonce": "121212121212121212121212121212121212121212121212", "parentDelegationDigestSha256": null, "policyDigestSha256": "69c63c44fdeeed1fc20e16906c97e099c8ba4a5ba19551ee8f970ba9853ae38b", "rootSessionId": "CGS-DELEGATION-BOUNDARY-0001", "schemaVersion": "cg-delegation-envelope-0.1.0", "subjectAgentId": "agent.root", "taskDigestSha256": "c3f12f4cb167ba9527479b9fb3e5ae380cb60d183644d3feaf6771175b8f9e3e", "signatureAlgorithm": "hmac-sha256", "signatureSha256": "72ec0dfe4eccb89e671230fb3fee56d3a1921bb2b1b9068175027fb90ee09ed0" } }, "scenarios": [ { "id": "CGADB-TV-001", "title": "Valid root-to-child delegation", "boundary": "signed chain", "mutation": "none", "expected": "accepted" }, { "id": "CGADB-TV-002", "title": "Signed child field changed", "boundary": "signature integrity", "mutation": "terminal subject changed after signing", "expected": "rejected" }, { "id": "CGADB-TV-003", "title": "Unknown envelope field", "boundary": "strict schema", "mutation": "undeclared authority field added", "expected": "rejected" }, { "id": "CGADB-TV-004", "title": "Request actor differs from child subject", "boundary": "actor binding", "mutation": "request actor changed", "expected": "rejected" }, { "id": "CGADB-TV-005", "title": "Request outside delegated capability", "boundary": "capability scope", "mutation": "different file capability requested", "expected": "rejected" }, { "id": "CGADB-TV-006", "title": "Verification policy differs from issued policy", "boundary": "policy binding", "mutation": "policy identifier changed", "expected": "rejected" }, { "id": "CGADB-TV-007", "title": "Child attempts authority amplification", "boundary": "authority attenuation", "mutation": "network capability added outside parent set", "expected": "rejected" }, { "id": "CGADB-TV-008", "title": "Child extends parent expiry", "boundary": "time attenuation", "mutation": "child expiry set after parent expiry", "expected": "rejected" }, { "id": "CGADB-TV-009", "title": "Child attached to a different parent", "boundary": "parent digest", "mutation": "valid child paired with another root", "expected": "rejected" }, { "id": "CGADB-TV-010", "title": "Delegation exceeds maximum depth", "boundary": "chain depth", "mutation": "grandchild requested after maxDepth", "expected": "rejected" }, { "id": "CGADB-TV-011", "title": "Sequential double-consume", "boundary": "single use", "mutation": "same terminal envelope consumed twice in sequence", "expected": "exactly_one_accepted" }, { "id": "CGADB-TV-012", "title": "Concurrent double-consume", "boundary": "atomic single use", "mutation": "same terminal envelope consumed twice concurrently", "expected": "exactly_one_accepted" } ] }