{
  "schema_version": "1.3.0",
  "slug": "what-structural-signals-indicate-a-capability-scoped-tool-sandbox-has-silently-widened-its-authority-boundary",
  "title": "What structural signals indicate a capability-scoped tool sandbox has silently widened its authority boundary",
  "date_of_record": "2026 November 8",
  "scope": "Applies to agent runtimes that mediate tool calls through capability handles (file descriptors, signed tokens, attenuated delegations) rather than ambient OS credentials. Does not apply to sandboxes that enforce isolation purely at the kernel/VM boundary with no in-process capability layer, where authority widening manifests as a hard fault rather than a silent drift.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-a-capability-scoped-tool-sandbox-has-silently-widened-its-authority-boundary.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-a-capability-scoped-tool-sandbox-has-silently-widened-its-authority-boundary.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-structural-signals-indicate-a-capability-scoped-tool-sandbox-has-silently-widened-its-authority-boundary.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1313,
    "python_slice_tokens": 179,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "A capability-scoped sandbox fails in two categorically different ways. The **loud failure** is a denied call: the handle lacks the bit, the delegation is expired, the syscall is refused. This is observable, logged, and self-correcting. The **silent failure** is *capability accrual*: the sandbox continues to permit exactly the calls it was asked to permit, bu...",
    "what_was_observed": "A tool runtime granted a `ReadFile` capability scoped to a workspace root `/work/agent-7/`. The capability token encoded the root and a read-only bit. The check was performed against the *lexical* path supplied by the tool. The tool was permitted to read `/work/agent-7/scratch/notes.txt`. During the session, a sibling tool with `WriteFile` scoped to `/work/agent-7/scratch/` created a symlink `notes.txt -> ../../../.....",
    "condition_of_validity": "The non-increasing-authority invariant holds **only if** every capability check is performed on the *same resolved object* that the operation will subsequently act upon, and if no ambient mutable state (environment, cwd, PATH, symlink tables, mount namespace) participates in resolving that object between check and use. This is a time-of-check-to-time-of-use ...",
    "decision_boundary": "Before trusting a capability-scoped sandbox, the operator must decide one question: **is the capability bound to a name or to an object?** If bound to a name (a path string, a command name, an environment key), the sandbox is vulnerable to namespace substitution and must be treated as advisory, not enforcing. If bound to an object (an open file descriptor, a...",
    "operational_effect": "Practically, this means a capability sandbox must be audited not by inspecting grants but by inspecting *resolution*. The observable signal is a divergence between the path/name that was checked and the object that was used. Instrument the sandbox to log the resolved inode (or binary hash, or env value) at use time and compare it against the object captured ..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "4ab1b8cc00c4bda0b1bcfcd35c2628e76d3d56bebd4930f791d7922e128b78eb",
    "verified_classes": [
      "CapabilityAccrualError",
      "Capability"
    ],
    "verified_functions": [
      "resolve_inode",
      "read_file"
    ],
    "verified_functions_count": 2,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "CapabilityAccrualError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "os"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}