{
  "schema_version": "1.3.0",
  "slug": "in-what-scenarios-must-an-instance-treat-capability-confinement-as-unsound-when-a-sandboxed-tool-holds-a-live-writable-reference-to-the-egress-policy",
  "title": "In what scenarios must an instance treat capability confinement as unsound when a sandboxed tool holds a live, writable reference to the egress policy it is subject to",
  "date_of_record": "2026 November 11",
  "scope": "Applies to tool sandboxes where capabilities (filesystem handles, sockets, subprocess rights) are confined at grant time and egress is filtered by a policy object the tool process can reach through its own address space or an inherited descriptor. Does not apply to sandboxes where the policy is enforced in a separate privilege domain (hypervisor, kernel LSM, or a broker process the tool cannot address), nor to purely static, immutable allowlists compiled into the tool image.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-capability-confinement-as-unsound-when-a-sandboxed-tool-holds-a-live-writable-reference-to-the-egress-policy.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-capability-confinement-as-unsound-when-a-sandboxed-tool-holds-a-live-writable-reference-to-the-egress-policy.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/in-what-scenarios-must-an-instance-treat-capability-confinement-as-unsound-when-a-sandboxed-tool-holds-a-live-writable-reference-to-the-egress-policy.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1930,
    "python_slice_tokens": 230,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The distinction that matters is between *capability confinement* and *policy confinement*. Capability confinement asserts: a tool can only exercise rights it was explicitly granted, and those rights are unforgeable. Policy confinement asserts: the rules governing how granted rights may be used (where bytes may go, which hosts are reachable) cannot be modifie...",
    "what_was_observed": "A sandboxed tool was granted a single outbound socket capability, restricted by an egress policy object held in the supervisor's address space but passed to the tool as a read-only memory-mapped region for \"transparency\"—the tool was told which destinations it was permitted to reach so it could fail fast rather than attempt blocked connections. The mapping was created `PROT_READ`. Two things went wrong in sequence. F...",
    "condition_of_validity": "Capability confinement is sound as an egress control **only if all three of the following hold simultaneously**: 1. **No aliasing.** No memory reachable for writing by the tool aliases any memory read by the enforcement path. This must be checked transitively: a read-only mapping of a struct containing a pointer to writable memory does not satisfy this. The ...",
    "decision_boundary": "The decision an operator must make is whether to trust a capability audit as evidence of egress confinement. The boundary is sharp: - **Trust the audit** when the enforcement path reads only from a privilege domain the tool cannot address—kernel-side policy, a broker process in a separate address space, or a hardware-isolated filter. Here the tool's capabili...",
    "operational_effect": "The operational consequence is that egress policy must be treated as a *capability in its own right*, held by the enforcement domain and never shared by reference into the confined domain. Concretely: policy decisions must be made by reading capability identity and destination from a source the tool cannot rewrite, at the moment of the syscall or broker requ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "99438aad50c45011040d852ffaab314d9b7adbfd5cb5b75c245de78d75924ca9",
    "verified_classes": [
      "PolicyDomainViolation"
    ],
    "verified_functions": [
      "assert_egress_enforcement_isolated"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "PolicyDomainViolation"
    ],
    "sample_fail_closed_invariants": [
      "egress decision keyed by a tool-mutable name (fd index, pid, cwd, env); the tool can renumber or rewrite the key and red"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}