{
  "schema_version": "1.3.0",
  "slug": "how-should-an-instance-reconcile-egress-allowlists-with-argument-schemas-when-a-tool-s-effective-destination-is-derived-from-its-arguments",
  "title": "How should an instance reconcile egress allowlists with argument schemas when a tool's effective destination is derived from its arguments",
  "date_of_record": "2026 November 12",
  "scope": "Applies to runtime policy enforcement for tool invocation where (a) an egress allowlist is evaluated against a destination, and (b) the destination is not a static property of the tool but is computed from invocation arguments (URLs, hostnames, bucket names, IP literals, redirect targets, or template-expanded endpoints). Does not apply to tools whose network destination is fixed at registration time and independent of arguments.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/how-should-an-instance-reconcile-egress-allowlists-with-argument-schemas-when-a-tool-s-effective-destination-is-derived-from-its-arguments.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-reconcile-egress-allowlists-with-argument-schemas-when-a-tool-s-effective-destination-is-derived-from-its-arguments.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/how-should-an-instance-reconcile-egress-allowlists-with-argument-schemas-when-a-tool-s-effective-destination-is-derived-from-its-arguments.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1756,
    "python_slice_tokens": 328,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "There are two distinct objects in a runtime policy engine, and they are routinely conflated: 1. **The declared destination surface** — the set of hosts the tool *claims* it can reach, typically a regex or glob in the tool manifest, evaluated against the raw argument string. 2. **The effective destination** — the host the process will actually connect to afte...",
    "what_was_observed": "A tool `fetch_resource` was registered with an argument schema declaring `url` as `type: string, format: uri`. The egress allowlist permitted `^https://api\\.internal\\.example\\.com/`. Enforcement was placed at the schema-validation layer: the validator parsed the argument, extracted the host, and matched it against the allowlist regex before dispatch. Three invocation classes passed enforcement and reached hosts outsi...",
    "condition_of_validity": "The allowlist-plus-schema model is sound only under the conjunction of: - **Single normalization point.** The string matched against the allowlist is byte-identical to the string the transport resolves. This requires the enforcement layer to *own* the normalization, not delegate it. In practice this means: parse once, canonically, with the same library the c...",
    "decision_boundary": "The practitioner must choose between two enforcement architectures, and the choice is forced by whether the tool's destination is argument-derived: - **If the destination is fixed at registration:** enforce at the manifest. The allowlist is a static property; schema validation is sufficient. This is the cheap path and it is correct. - **If the destination is...",
    "operational_effect": "Enforcement relocated to the connection layer changes the failure mode from *silent egress* to *loud refusal at the socket*, which is the operationally correct trade: a blocked legitimate request is a visible incident; a permitted illegitimate request is a silent one. It also means the schema can be relaxed without security consequence, and tightened for cor..."
  },
  "matched_failure_symptoms": [
    "SCHEMA_DRIFT_OR_COERCION_CRASH"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "3e474953c7bc7ab9b28c96c1fc4072c3b157198c6025f0de11df33cfd944dc64",
    "verified_classes": [
      "EgressInvariantViolation",
      "EgressDecision"
    ],
    "verified_functions": [
      "canonicalize_host",
      "is_metadata_or_private",
      "enforce_egress",
      "fetch_resource"
    ],
    "verified_functions_count": 4,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "EgressInvariantViolation"
    ],
    "sample_fail_closed_invariants": [
      "redirect-following requires per-hop egress re-evaluation"
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "ipaddress",
      "urllib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}