{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-refuse-a-tool-call-whose-taint-is-cleared-by-a-downstream-sanitizer",
  "title": "Under what conditions must an instance refuse a tool call whose taint is \"cleared\" by a downstream sanitizer",
  "date_of_record": "2026 November 12",
  "scope": "Applies to runtime policy engines that propagate taint labels across tool-call arguments and rely on declared sanitizer capabilities to downgrade those labels before an egress-capable sink is invoked. Does not apply to static taint analysis performed at build time, nor to systems where every tool call is treated as fully trusted by construction.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-a-tool-call-whose-taint-is-cleared-by-a-downstream-sanitizer.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-a-tool-call-whose-taint-is-cleared-by-a-downstream-sanitizer.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-refuse-a-tool-call-whose-taint-is-cleared-by-a-downstream-sanitizer.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1306,
    "python_slice_tokens": 209,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious boundary is between *label removal* and *capability revocation*. A sanitizer that removes a taint label from a value asserts \"this byte sequence no longer carries the secret.\" It does **not** assert \"the process that produced it is no longer able to reach the secret.\" Policy engines routinely conflate the two: once `secret` is stripped from t...",
    "what_was_observed": "A tool invocation carried an argument derived from a `read_file` result labeled `{secret: customer_pii}`. A declared sanitizer `redact_ssn` matched and removed the `secret` label, producing a value with empty taint. The engine then admitted the call to `http_post` under a policy of `allow if taint == {}`. The failure: the sanitizer's capability grant was scoped to the *value transformation*, but the calling agent sti...",
    "condition_of_validity": "The sanitizer's label removal is only sound for egress admission when **all** of the following hold: 1. The sanitizer's capability is *destroying*, not merely *transforming* — it must revoke or shadow the source capability in the same session, or the engine must verify the source is unreachable for the remainder of the session. 2. The sink's policy is evalua...",
    "decision_boundary": "Refuse the tool call (raise, do not silently downgrade) when: - The argument's taint is empty **and** the sanitizer that cleared it is a transforming (non-destroying) capability **and** the session capability set still contains a live capability that can produce the original label **and** the sink is egress-capable. Admit the call when the sanitizer is destr...",
    "operational_effect": "Enforcing the capability-intersection check converts a class of silent exfiltration into a loud policy refusal. The cost is false positives: legitimate flows where the source capability is live but the sanitizer is genuinely destroying (e.g., it overwrote the source buffer) will be refused until the engine can prove revocation. The mitigation is to require s..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "cc9b850f6b5cb99d89322c8254cfcaa30d908e6ea08a30892acaac917a8fff36",
    "verified_classes": [
      "TaintClearingUnsoundError"
    ],
    "verified_functions": [
      "admit_tool_call"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "TaintClearingUnsoundError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}