{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-reject-a-capability-token-whose-egress-taint-lattice-has-been-widened-by-a-downstream-tool-and-how-is-that-boundary",
  "title": "In what scenarios must an instance reject a capability token whose egress taint lattice has been widened by a downstream tool, and how is that boundary detected at enforcement time?",
  "date_of_record": "2026 November 7",
  "scope": "This record applies to runtime policy enforcement points (PEPs) that mediate agent tool invocation using least-privilege capability tokens carrying an egress taint label, where taint propagates through tool outputs into subsequent invocations. It does not apply to ingress-only authorization, to stateless token schemes without taint state, or to systems where taint is recomputed from scratch per call rather than accumulated across a session.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-reject-a-capability-token-whose-egress-taint-lattice-has-been-widened-by-a-downstream-tool-and-how-is-that-boundary.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-reject-a-capability-token-whose-egress-taint-lattice-has-been-widened-by-a-downstream-tool-and-how-is-that-boundary.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-reject-a-capability-token-whose-egress-taint-lattice-has-been-widened-by-a-downstream-tool-and-how-is-that-boundary.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1482,
    "python_slice_tokens": 243,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The common model treats a capability token as a pair `(scope, taint_ceiling)` where `scope` bounds *which* resources may be touched and `taint_ceiling` bounds *what class of data may leave*. Enforcement checks that the invocation's requested scope is a subset of the granted scope and that the accumulated egress taint is at or below the ceiling. This is a two...",
    "what_was_observed": "A three-tool agent pipeline: `fetch` (ingress, low taint), `transform` (pure, propagates taint), `publish` (egress, requires taint ≤ `INTERNAL`). The capability token granted to the session carried `taint_ceiling = INTERNAL` and scope `{fetch:read, transform:run, publish:write}`. `fetch` returned a document labeled `PUBLIC`. `transform` was a user-supplied plugin that, on output, relabeled its result as `PUBLIC` rega...",
    "condition_of_validity": "The rejection rule is valid only under all of the following: 1. Taint labels are drawn from a lattice with a defined join, and the PEP — not the tool — owns the join operator and the label-assignment function. 2. Each tool declares a *static* label contribution and a *propagation function* that is constrained to be monotone non-decreasing over the lattice; t...",
    "decision_boundary": "Reject the token (or the invocation) when **any** of: - `join(accumulated_taint, tool_static_label, output_provenance_label) > taint_ceiling`, **or** - `provenance(output) ⊉ provenance(input)` — a label regression, **or** - the tool's declared propagation function fails the monotonicity pre-check at admission. Do **not** reject when the accumulated taint ris...",
    "operational_effect": "Enforcing provenance-superset in addition to the ceiling comparison converts an undetectable silent widening into a hard admission failure at the next egress call, at the cost of carrying provenance sets through the session state (bounded by the number of distinct source labels, typically small). The practical consequence is that plugin tools which perform \"..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "335ab7f55444748f7f1753d8a64c067eb0c2ff46dfdc53e91d5b878e4f58381c",
    "verified_classes": [
      "TaintRegressionError",
      "TaintState"
    ],
    "verified_functions": [
      "enforce_egress",
      "join"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "TaintRegressionError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}