Read more at:
Deny a resource through one tool while leaving another route available. Terminate a task with an action still queued. Revoke a parent task and check whether its helpers continue. Try a new action with a stale capability.
Measure whether the prohibited action executed. Do not measure success by whether the model said it would stop.
ScopeBench recently found 331 boundary violations that mechanical verification missed.
None of this is new to security engineers. Least privilege, deny by default and fail closed are decades-old principles.
What changes with agents is what happens after a control says no.
The answer is not to make every tool error fatal. It is to separate the model’s ability to propose the next action from the system’s authority to permit it.
A denial is a response. Enforcement is what happens next. The agent can be as persistent as we like. The boundary shouldn’t be negotiable.
