Governance lives at the action boundary.

Video caption

Governance lives at the action boundary.

A new tool can bypass a previously tested hook.

Object, principal, operation, recipient and expiry.

My rule: The action service is the last shared choke point.

#EricFieldNotes

Full written post / accessibility read

Many AI governance plans list prohibited outputs but leave the same agent with broad production credentials. If the sensitive outcome is a transfer, deployment, refund or customer change, policy must be enforced where that change is accepted.

A team adds a generic workflow tool after writing a specific pre-tool deny. It indirectly calls the restricted service. The old hook still passes its unit test, but the total capability graph changed. New agent routes create new permission surfaces.

Require the target service to check a current permit for the acting identity and exact object. Scope credentials so a different tool cannot broaden it. Then inject an out-of-scope request through each route and verify a denial and unchanged target state.

Review every credential and tool capable of the consequential effect, then test denial at the service. Do this because a model's token stream is upstream of business authority; censoring it cannot replace a permission check.

#EricFieldNotes

Four-beat scene transcript

1. Governance lives at the action boundary.

Many AI governance plans list prohibited outputs but leave the same agent with broad production credentials. If the sensitive outcome is a transfer, deployment, refund or customer change, policy must be enforced where that change is accepted.

Visual: A vocabulary rule is not a permission model.

2. The path changes as systems evolve.

A team adds a generic workflow tool after writing a specific pre-tool deny. It indirectly calls the restricted service. The old hook still passes its unit test, but the total capability graph changed. New agent routes create new permission surfaces.

Visual: A new tool can bypass a previously tested hook.

3. Make permissions independent of agent route.

Require the target service to check a current permit for the acting identity and exact object. Scope credentials so a different tool cannot broaden it. Then inject an out-of-scope request through each route and verify a denial and unchanged target state.

Visual: Object, principal, operation, recipient and expiry.

4. Audit the authority graph, not the prompt library.

Review every credential and tool capable of the consequential effect, then test denial at the service. Do this because a model's token stream is upstream of business authority; censoring it cannot replace a permission check.

Visual: The action service is the last shared choke point.

Research and claim limits

• XGrammar: engine integration (S173)
• OpenAI Agents SDK: handoffs (S131)
• OpenAI: Structured Outputs guide (S175)

The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.