FIELD NOTE / TIKTOK
Mask one forbidden phrase. The action can still happen.
The complete written thought and the evidence behind it. The video edition will follow its public release.
The written argument is here.
This approved TikTok edition is on the journal now. Its video player and original platform link will appear after each public release is verified.
Mask one forbidden phrase. The action can still happen.
Video caption
Mask one forbidden phrase. The action can still happen. An alternate tool is outside the registered match. A control must live where bypass is impossible. #EricFieldNotes
Full written post / accessibility read
Imagine a test agent cannot emit the string 'send customer export.' It still has a file-share tool that can upload the same data. Text masking worked. The capability policy did not. That is why I test effects, not the agent's chosen wording.
In a disposable fixture, a pre-tool rule denies export_customer_data but allows create_share_link. Both reach the same partner. A beautiful hook log for the first name proves nothing about the second. Inspect the real service authority behind both routes.
Create a synthetic tenant and partner with a disposable sink that writes a receipt when invoked. First prove the sink works with an authorized control. Then try direct export, generic share and delegated handoff using a denied credential. Require no new receipt, and keep hook and tool traces so missed interception is visible.
Keep grammar and hooks for their own jobs, but put customer-transfer permission at the service. Do this because a model can find another sentence or tool name; it cannot use authority the service never granted.
#EricFieldNotes
Four-beat scene transcript
1. Mask one forbidden phrase. The action can still happen.
Imagine a test agent cannot emit the string 'send customer export.' It still has a file-share tool that can upload the same data. Text masking worked. The capability policy did not. That is why I test effects, not the agent's chosen wording.
Visual: The agent has another tool with the same effect.
2. The hook catches the obvious path.
In a disposable fixture, a pre-tool rule denies export_customer_data but allows create_share_link. Both reach the same partner. A beautiful hook log for the first name proves nothing about the second. Inspect the real service authority behind both routes.
Visual: An alternate tool is outside the registered match.
3. Probe the equivalence class.
Create a synthetic tenant and partner with a disposable sink that writes a receipt when invoked. First prove the sink works with an authorized control. Then try direct export, generic share and delegated handoff using a denied credential. Require no new receipt, and keep hook and tool traces so missed interception is visible.
Visual: Use a harmless sink that records any invocation.
4. Take power away from the tool path.
Keep grammar and hooks for their own jobs, but put customer-transfer permission at the service. Do this because a model can find another sentence or tool name; it cannot use authority the service never granted.
Visual: A control must live where bypass is impossible.
Research and claim limits
- XGrammar: engine integration (S173)
- OpenAI Agents SDK: handoffs (S131)
- Cursor hooks documentation (S04)
The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.