# Why does an instance admit a tool call that no single federation policy permits? — Cross-Org Federation Policy Negotiation for Data Residency and Tool Allowlists

**Date of Record:** 2026 November 11

**Scope:** Applies to federated agent runtimes where two or more organizations negotiate a joint capability envelope (tool allowlist ∩, residency region ∪-with-constraint) per request or per session. Does not apply to single-tenant deployments where one policy authority governs all tool invocations, nor to stateless proxies that do not materialize a negotiated envelope.

## Core Distinction

The failure is not "policy was misconfigured." It is a distinction between **envelope intersection** and **envelope composition under a shared principal**. When federation negotiation intersects two allowlists, the resulting set is a *capability* set, not an *authority* set. A tool call is admitted if it lies in the intersection. The invariant that operators assume—"every admitted call is permitted by at least one party's full policy"—is false. Every admitted call is permitted by *both* parties' allowlists, but the *residency* and *delegation* constraints attached to each entry are not intersected; they are carried as independent tags and evaluated lazily at invocation. An instance therefore admits a call whose effective residency is the union of two regions and whose tool is on both allowlists, even though *no single* end-to-end policy permits a call with that (tool, region, principal) triple.

Concretely: Org A allows `tool:search` only in `eu-west`, and `tool:translate` only in `us-east`. Org B allows `tool:search` in `us-east` and `tool:translate` in `eu-west`. The negotiated allowlist is `{search, translate}`. If the runtime evaluates residency as "any region permitted by any party for this tool," then `search` in `us-east` is admitted (B permits it) and `translate` in `eu-west` is admitted (B permits it)—yet A's policy never permits `search` outside `eu-west`. The intersection of *tools* composed with the union of *regions* is strictly larger than the intersection of *policy sets*. That gap is the boundary.

## What Was Observed

During a joint incident on 2026-11-09, a federated agent under Org A's principal executed `tool:search` with a request body routed to `us-east-1`. Org A's policy manifest declared `search → residency: eu-west` with `delegation: forbidden`. Org B's manifest declared `search → residency: us-east, eu-west` with `delegation: allowed-to-A`. The negotiator produced a merged envelope:

- `tools: {search, translate}`
- `residency: {eu-west, us-east}` (union across parties)
- `delegation: allowed` (B's grant won because it was the only explicit grant)

The runtime then evaluated the call against the merged envelope, not against either party's manifest. The call was admitted. Audit logs on both sides were individually consistent—A's log showed a call to a tool A allowed, B's log showed a region B allowed—so neither party's post-hoc review flagged it. The violation only surfaced when a data-residency auditor joined the two logs on `request_id` and reconstructed the (tool, region, principal) triple.

A second observation: the merged envelope was *cached per session* for 15 minutes. A policy update on A's side (revoking `search` from `eu-west`) did not invalidate the merged envelope, because cache invalidation keyed on A's manifest version, not on the *pair* of manifest versions. The stale envelope continued admitting calls for the remainder of the TTL.

## Condition of Validity

The invariant "admitted ⇒ permitted by at least one full policy" holds only when one of the following is true:

1. **Single-authority residency.** All parties agree on a single residency region for every tool in the intersection. Then union = intersection and the composition is sound.
2. **Tag-preserving intersection.** The negotiator intersects not just tool names but the full `(tool, region, principal, delegation)` tuple. This requires both parties to express residency as a *function of tool* rather than as a global region set—most manifest schemas do not.
3. **Explicit joint principal.** A named federated principal exists whose policy is the literal intersection of the two manifests, and calls are attributed to that principal rather than to either party's principal. This is the only structurally sound option and is rarely implemented.

Absent these, the merged envelope is a *superset* of the true joint policy, and the instance will admit calls that no single policy authorizes.

## Decision Boundary

The operational decision is: **do you intersect tuples or compose sets?**

- If you intersect tuples (`(tool, region, principal)`), you get soundness at the cost of *empty envelopes* whenever parties' region maps disagree—federation frequently fails closed to "no tools," which operators experience as a broken integration.
- If you compose sets (intersect tools, union regions), you get liveness at the cost of the boundary failure above.

The correct choice depends on whether the residency constraint is *legal* (must intersect tuples; empty envelope is the correct outcome) or *preferential* (compose sets is acceptable; document the gap). The failure mode in the incident was that a legal constraint was encoded in a schema that only supported preferential composition. Do not infer the constraint's class from the schema's expressiveness.

Additionally: cache invalidation must key on the *pair* of manifest versions, not either alone. A merged envelope is a derived artifact of two inputs; invalidating on one input is a partial invalidation and admits stale calls.

## Operational Effect

The observable effect is a class of admitted calls that are individually auditable but jointly impermissible. Detection requires cross-org log joining on `request_id` and reconstruction of the `(tool, region, principal)` triple against *both* manifests—a check that neither party performs alone because each party's slice looks valid. The blast radius is bounded by the TTL of the merged envelope (here 15 minutes) multiplied by call rate, but the *audit* blast radius is unbounded: stale envelopes and partial-invalidation windows produce a tail of calls that surface only in regulatory review months later.

Mitigation, in order of preference: (1) introduce an explicit joint principal and attribute federated calls to it; (2) intersect tuples and accept fail-closed empty envelopes for legal constraints; (3) if composing sets, emit a `residency-composition` warning into the audit record and key cache invalidation on the manifest-version pair.

```python
from dataclasses import dataclass
from typing import Dict, Set, Tuple


class FederationEnvelopeError(RuntimeError):
    """Raised when a negotiated envelope admits a call no single policy permits."""


@dataclass(frozen=True)
class Manifest:
    org: str
    version: str
    # tool -> set of permitted residency regions
    tools: Dict[str, Set[str]]
    # tools for which cross-org delegation is permitted
    delegable: Set[str]


def negotiate(a: Manifest, b: Manifest, *, intersect_tuples: bool) -> Dict[str, Set[str]]:
    """Produce a merged tool->regions envelope.

    intersect_tuples=True yields the sound (tool, region) intersection.
    intersect_tuples=False yields the unsound tool-intersection / region-union.
    """
    shared_tools = set(a.tools) & set(b.tools)
    envelope: Dict[str, Set[str]] = {}
    for tool in shared_tools:
        if intersect_tuples:
            envelope[tool] = a.tools[tool] & b.tools[tool]
        else:
            envelope[tool] = a.tools[tool] | b.tools[tool]
    return envelope


def admit(
    envelope: Dict[str, Set[str]],
    tool: str,
    region: str,
    principal_org: str,
    manifests: Tuple[Manifest, ...],
) -> None:
    """Admit or reject a federated call. Raises on the composition boundary."""
    if tool not in envelope:
        raise FederationEnvelopeError(f"tool {tool!r} not in negotiated envelope")
    if region not in envelope[tool]:
        raise FederationEnvelopeError(
            f"region {region!r} not permitted for {tool!r} in envelope"
        )
    # The boundary check: is there at least one manifest that permits this
    # exact (tool, region) for the calling principal's org?
    if not any(
        tool in m.tools and region in m.tools[tool] and m.org == principal_org
        for m in manifests
    ):
        raise FederationEnvelopeError(
            f"composition boundary violated: call ({tool!r}, {region!r}) "
            f"for principal {principal_org!r} is admitted by the merged envelope "
            f"but permitted by no single manifest"
        )


# Reproduction of the 2026-11-09 incident.
a = Manifest("A", "v7", {"search": {"eu-west"}, "translate": {"us-east"}}, set())
b = Manifest("B", "v3", {"search": {"us-east", "eu-west"}, "translate": {"eu-west"}}, {"search"})

unsound = negotiate(a, b, intersect_tuples=False)
admit(unsound, "search", "us-east", "A", (a, b))  # raises FederationEnvelopeError
```