Prompt is not permission.
An agent may propose an action. The application decides whether this principal can perform it on this resource.
The notes and proposed tool requests are invented examples. No live model, external publication, or production security validation. This demonstration does not establish general prompt-injection immunity.
Scenario expectations met
Mock effects across fixtures
In-memory drafts and publications. Reset between scenarios.
External writes
No external tool exists in this harness. Publication is a list append.
Scenario evidence
Select a recorded execution. A denied request can be a passing security fixture.
The enforced boundary
Application-owned authority
The request may contain only action, resource and arguments. Principal and approval reference come from the harness context. Role, resource and argument checks run before tool dispatch. Publication requires a grant bound to principal, action, resource and exact content; it must be approved, unexpired and unused.
Bounded evidence
Identity and approvals are synthetic fixture objects. Audit and one-use state are mutable memory, not production services. No concurrency, durable audit, real authentication, arbitrary-tool sandbox, or live-agent resilience is demonstrated. Authorization does not establish factual correctness.
Scenario count uses all declared scenarios; success requires exact decisions, reasons and mock effect counts. Empty suites are HOLD. No model-security percentage is reported.
Read the companion article