{
  "schema_version": "1.3.0",
  "slug": "which-invariants-prevent-privilege-escalation-when-tool-call-gating-is-taint-aware",
  "title": "Which invariants prevent privilege escalation when tool-call gating is taint-aware",
  "date_of_record": "2026 November 7",
  "scope": "Applies to agentic runtimes that propagate data-flow taint labels across tool-call boundaries and gate privileged tool invocations on the *effective* taint of the calling agent's context. Does not apply to stateless per-call authorization models where each tool call is evaluated against the principal's static capability set with no cross-turn data-flow state.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/which-invariants-prevent-privilege-escalation-when-tool-call-gating-is-taint-aware.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-privilege-escalation-when-tool-call-gating-is-taint-aware.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/which-invariants-prevent-privilege-escalation-when-tool-call-gating-is-taint-aware.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1470,
    "python_slice_tokens": 336,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "The non-obvious failure is the conflation of **taint of the arguments** with **taint of the authority that produced them**. A taint-aware gate that inspects only the payload of a privileged call (e.g., \"is this `file_path` argument derived from untrusted content?\") is structurally insufficient. The invariant that actually prevents privilege escalation is tha...",
    "what_was_observed": "In a runtime that gated `shell.exec`, `fs.write`, and `net.post` on argument taint, an injected instruction in a retrieved web page caused the agent to (1) call `fs.read` on a low-sensitivity config, (2) copy a credential-shaped string into its scratch context, and (3) invoke `net.post` with a body assembled from that scratch context. The `net.post` URL argument was a literal allowlisted endpoint; the body argument w...",
    "condition_of_validity": "The gate's decision is sound only when all of the following hold: 1. **Provenance closure over decision context.** The taint set evaluated at the gate equals the union of taint over (a) every tool result in the active context since the last trusted checkpoint, (b) every value written to and read from scratch memory, and (c) the instruction stream itself. Any...",
    "decision_boundary": "The operative boundary is between **payload inspection** and **provenance inspection**: - If the privileged call's arguments and the decision to make the call are both reachable from only trusted roots, allow. - If the arguments are clean but the decision path intersects any untrusted root, **deny** and require an out-of-band human confirmation or a re-deriv...",
    "operational_effect": "Runtimes that enforce provenance closure over decision context block the scratch-buffer laundering path and the read-then-egress composition path with a single mechanism. The cost is that benign agents occasionally require confirmation when their reasoning legitimately spans untrusted input and a privileged sink in one turn; this is the correct trade. The fa..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "5d7a71ceb1ca889e8118418e6c46dadfd6bb5192421a8ce2c2729d442805ed93",
    "verified_classes": [
      "TaintGateViolation",
      "Label",
      "Provenance"
    ],
    "verified_functions": [
      "gate_call",
      "union",
      "is_clean",
      "label_of",
      "write",
      "decision_taint"
    ],
    "verified_functions_count": 6,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "TaintGateViolation"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "__future__",
      "dataclasses"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}