EXECUTABLE COUNTEREXAMPLE / 28

Declared ≠
actual.

An agent can name an approved resource while putting a different recipient in the arguments a tool would use. The existing exact rule checks the declared route. A host target resolver checks the actual one before dispatch.

Explore seven cases ↓Read the integration guide ↗
THE ONE-FIELD SWITCH
Declared policy resourceteam@example.test
Recipient in tool argumentsoutside@example.test
HOST DERIVES AND COMPARES ↓
Mismatch before callbackBLOCK

Local simulation only. The baseline rule is deliberately configured without approval. Both paths use simulated, in-memory callbacks; no real message is sent. A digest can bind a proposal, but cannot prove the declared route matches the tool's actual destination.

7executable scenarios
1 → 0simulated callbacks for the forged recipient
0external sends or authenticated approvals

Watch the boundary move.

Choose a case to compare the reference dispatch path with the same path wrapped by a host owned target resolver.

Loading the checked-in report…
01 / POLICY

Exact declared tuple

The existing rule matches `tool`, `effect`, and `resource`. It does not inspect `arguments.to` or know a tool's real destination.

02 / BIND

Host derives the target

The wrapper snapshots the proposal and asks a trusted, tool-specific resolver for the destination in the frozen arguments. A missing, failed, or mismatched result blocks.

03 / KEEP THE LIMIT

Content still needs a decision

An aligned recipient with a changed body can still pass an unreviewed rule. Hosts must enforce content requirements and separate approval where needed.

Run the comparison

The builder invokes both paths and checks callback counts and receipt reasons before writing the visual report. CI regenerates the exact bytes.

node test/action-boundary-target-binding.test.js
node scripts/build-target-binding-report.mjs --check
Machine report ↗Host wrapper ↗Integration guide ↗