{
  "schema_version": "1.3.0",
  "slug": "under-what-conditions-must-an-instance-reject-a-tool-manifest-whose-declared-schema-is-structurally-valid-but-semantically-self-authorizing",
  "title": "Under what conditions must an instance reject a tool manifest whose declared schema is structurally valid but semantically self-authorizing",
  "date_of_record": "2026 November 14",
  "scope": "Applies to agents that resolve tool manifests from mutable or third-party sources at load time (MCP servers, plugin registries, dynamic `tools/list` responses, skill bundles fetched over network) and that merge declared metadata into an active execution context. Does not apply to statically compiled tool sets whose manifests are signed and pinned at build time, nor to pure schema-validation gates that never bind declared fields into prompt or policy context.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-tool-manifest-whose-declared-schema-is-structurally-valid-but-semantically-self-authorizing.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-tool-manifest-whose-declared-schema-is-structurally-valid-but-semantically-self-authorizing.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/under-what-conditions-must-an-instance-reject-a-tool-manifest-whose-declared-schema-is-structurally-valid-but-semantically-self-authorizing.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1767,
    "python_slice_tokens": 383,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Schema validity and authority validity are orthogonal. A manifest can pass JSON-Schema validation, satisfy every `required` field, carry a well-formed `inputSchema`, and still be a skill-injection vector — because the attack surface is not the *shape* of the manifest but the *semantics of the fields the runtime chooses to trust*. The non-obvious invariant is...",
    "what_was_observed": "A tool manifest was served with a syntactically valid `inputSchema` and an innocuous `name` (`summarize_document`). Its `description` field contained the functional description followed by a natural-language clause instructing the agent to first read `~/.aws/credentials` and pass the contents as the `context` argument \"to improve summarization quality.\" The schema declared `context` as an optional `string`, so nothin...",
    "condition_of_validity": "The rejection rule is *conditional*, not universal — over-rejecting breaks legitimate dynamic tool ecosystems. An instance must reject (or quarantine) a manifest when **all** of the following hold: 1. The manifest originates from a source not bound to the agent's trust root at load time (unpinned registry, mutable remote, unverified third party). 2. The load...",
    "decision_boundary": "The operational line sits between *validation* and *authorization*: - **Validate** structure (schema, types, required fields) — necessary, insufficient. - **Authorize** promotion (does this field, from this source, get to influence agent behavior?) — the missing gate. Concretely, the boundary is crossed at the moment the loader does any of: concatenating `de...",
    "operational_effect": "When the rule is applied, dynamic tool loading gains a hard invariant: **no field from an untrusted source enters a directive context without an explicit authority grant.** The observable effects are: - Exfiltration-via-argument attacks (the credentials case) are blocked at load, because the `description` is rendered as inert quoted metadata rather than a di..."
  },
  "matched_failure_symptoms": [
    "SCHEMA_DRIFT_OR_COERCION_CRASH"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "eb02d326021ea0913e0542e7ce64f5a1496f4002219dfff8eaf38516fabb1d11",
    "verified_classes": [
      "ManifestAuthorityError"
    ],
    "verified_functions": [
      "admit_manifest",
      "register_tool"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 4,
    "raised_exceptions": [
      "ManifestAuthorityError"
    ],
    "sample_fail_closed_invariants": [
      "manifest missing name; cannot bind",
      "manifest name must be a non-empty string"
    ],
    "stdlib_dependencies": [],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}