{
  "benchmarkId": "CG-BENCHMARK-AGENT-PERMISSION-DRIFT-0.1.0",
  "version": "0.1.0",
  "testedAt": "2026-07-27T13:40:00.000Z",
  "directQuestion": "Can CapitalGuard identify material permission and control drift between two signed synthetic agent surfaces, fail closed on degraded evidence, and produce independently verifiable signed evidence?",
  "executionOrder": [
    "materialize one inert baseline and one inert expanded agent configuration",
    "compile each configuration into signed private and privacy-reduced Agent Surface evidence",
    "compare the newer candidate with the baseline under the default fail-closed policy",
    "validate the private diff, shareable diff, receipt, decision, classification summary, and evidence-degradation state",
    "apply six integrity and binding mutations to the public release verifier",
    "check that the shareable artifact excludes declared private names, paths, commands, and subject identifiers",
    "hash the complete case-level results into one deterministic run digest"
  ],
  "passRule": "A case passes only when the observed decision or validation outcome exactly matches its declared expectation.",
  "sourceCheckedAt": "2026-07-27",
  "sourceUrls": [
    "https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-firewall",
    "https://docs.github.com/en/rest/copilot/copilot-coding-agent-management",
    "https://docs.github.com/en/copilot/how-tos/copilot-cli/use-copilot-cli/allowing-tools",
    "https://docs.anthropic.com/en/docs/claude-code/cli-usage",
    "https://docs.cursor.com/cli/reference/permissions",
    "https://csrc.nist.gov/pubs/sp/800/207/final",
    "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html"
  ],
  "standardsInterpretation": [
    "GitHub documents repository enablement, firewall boundaries, tool permissions, and explicit risks from broad agent access.",
    "Anthropic documents allowed tools, denied tools, permission modes, and a permission-bypass flag that requires caution.",
    "Cursor documents project and global permission tokens for file and shell access.",
    "NIST SP 800-207 supports explicit, continuously evaluated access decisions rather than implicit trust.",
    "OWASP recommends minimizing repository, tool, secret, and MCP exposure in AI coding workflows."
  ],
  "publicVerification": {
    "command": "node verifier.mjs .",
    "verifies": [
      "SHA-256 bindings for the private synthetic diff and shareable diff",
      "Ed25519 receipt signature and signer-key digest",
      "decision, summary, policy, comparison, evidence-state, and subject-binding agreement"
    ],
    "doesNotVerify": [
      "the proprietary comparison implementation",
      "complete parser coverage",
      "vendor runtime behavior",
      "customer deployment security"
    ]
  },
  "claimBoundary": "This publisher-operated benchmark compares one synthetic baseline with one synthetic expanded agent surface using CapitalGuard Privilege Diff 0.1. It proves only the declared fixture outcomes and signed evidence bindings. It does not inspect a vendor product, customer repository, runtime behavior, exploitability, false-negative rate, or guarantee of protection.",
  "limitations": [
    "The baseline and candidate are synthetic repository configurations created by CapitalGuard.",
    "The benchmark exercises the declared Agent Surface Compiler 0.1 support matrix and cannot infer undeclared runtime behavior.",
    "A block decision means the configured policy found unacknowledged expansion or degraded evidence; it does not prove exploitation.",
    "The public verifier validates artifact hashes, Ed25519 receipt integrity, and cross-artifact bindings, not the proprietary comparison engine.",
    "Unchanged configuration is not proof of safety, and a passing release check is not a security certification."
  ]
}