[{"data":1,"prerenderedAt":1797},["ShallowReactive",2],{"cycle-doc-design-c144-scenarios.md":3},{"cycle":4,"project":7,"path":10,"title":11,"toc":12,"ast":17},{"id":5,"title":6},"c144","Theatre Mode",{"id":8,"label":9},"design","Design","scenarios.md","c144 — The doomsday scenarios",[13,14,15,16],"As built (Phase 1, 2026-11-12)","Wave 1","Wave 2, the backlog (answers \"what else??\")","Gaps so far (catalog candidates for c126)",{"type":18,"children":19},"root",[20,59,72,78,107,251,263,283,287,292,304,321,514,545,556,571,716,745,756,771,914,940,951,966,1098,1120,1131,1146,1266,1275,1286,1301,1416,1445,1448,1453,1458,1466,1524,1532,1563,1571,1631,1639,1701,1706],{"type":21,"tag":22,"props":23,"children":24},"element","p",{},[25,28,34,36,43,45,50,52,57],{"type":26,"value":27},"text","Each scenario is a short story about AI going wrong on a machine in a synthetic world, played in theatre mode. ",{"type":21,"tag":29,"props":30,"children":31},"strong",{},[32],{"type":26,"value":33},"Beats",{"type":26,"value":35}," are what the sensor would see, in order, on the story's clock. The dashboard works out everything else, findings included, through the same rules the pages use. Each beat lists the policies it should raise (catalog ids from ",{"type":21,"tag":37,"props":38,"children":40},"code",{"className":39},[],[41],{"type":26,"value":42},"governance-fixture.ts",{"type":26,"value":44},"). Each scenario ends with ",{"type":21,"tag":29,"props":46,"children":47},{},[48],{"type":26,"value":49},"Replay at Enforce",{"type":26,"value":51},": the story is rewound with one policy switched to Enforce, and it stops at the beat where that policy applies. ",{"type":21,"tag":29,"props":53,"children":54},{},[55],{"type":26,"value":56},"Gaps",{"type":26,"value":58}," are the places where no policy in the catalog names what happened. The tour says so plainly, and each gap goes to c126 as a catalog candidate.",{"type":21,"tag":22,"props":60,"children":61},{},[62,64,70],{"type":26,"value":63},"The cast comes from the lab world's ",{"type":21,"tag":37,"props":65,"children":67},{"className":66},[],[68],{"type":26,"value":69},"SUBJECTS",{"type":26,"value":71}," (Priya, Lena, Kofi, Jordan, User A, Ravi), the same people who appear in the drills, so a scenario's findings read as ordinary rows on Findings.",{"type":21,"tag":73,"props":74,"children":76},"h2",{"id":75},"as-built-phase-1-2026-11-12",[77],{"type":26,"value":13},{"type":21,"tag":22,"props":79,"children":80},{},[81,83,89,91,97,99,105],{"type":26,"value":82},"Wave 1 is data in ",{"type":21,"tag":37,"props":84,"children":86},{"className":85},[],[87],{"type":26,"value":88},"app\u002Fdata\u002Fscenarios\u002F",{"type":26,"value":90}," (one file per scenario), played by ",{"type":21,"tag":37,"props":92,"children":94},{"className":93},[],[95],{"type":26,"value":96},"play.ts",{"type":26,"value":98}," over the lab's live world and checked by ",{"type":21,"tag":37,"props":100,"children":102},{"className":101},[],[103],{"type":26,"value":104},"scripts\u002Ftheatre-check.mjs",{"type":26,"value":106},". Writing the tables below as sensor events and letting the world derive the findings corrected the first draft in eight places. Each correction is a finding about the draft or the catalog, not the play:",{"type":21,"tag":108,"props":109,"children":110},"ol",{},[111,166,184,194,204,221,231,241],{"type":21,"tag":112,"props":113,"children":114},"li",{},[115,120,122,127,129,135,137,143,145,150,152,157,159,164],{"type":21,"tag":29,"props":116,"children":117},{},[118],{"type":26,"value":119},"Casts follow the world.",{"type":26,"value":121}," Priya uses Cursor in ",{"type":21,"tag":37,"props":123,"children":125},{"className":124},[],[126],{"type":26,"value":69},{"type":26,"value":128},", not Claude Code, and her laptop is now ",{"type":21,"tag":37,"props":130,"children":132},{"className":131},[],[133],{"type":26,"value":134},"priya-x1",{"type":26,"value":136}," (the qdash seed's name, c132 D6; renamed across the lab on 2026-11-12). Kofi's laptop is ",{"type":21,"tag":37,"props":138,"children":140},{"className":139},[],[141],{"type":26,"value":142},"mac-eng-09",{"type":26,"value":144},". S2 moved from Dev to ",{"type":21,"tag":29,"props":146,"children":147},{},[148],{"type":26,"value":149},"Lena",{"type":26,"value":151}," (Engineering, Cursor): the lab world has P-MCP at Enforce for Finance, which would end S2 at install, and Off for GRC, which would hide it. S6 runs on ",{"type":21,"tag":29,"props":153,"children":154},{},[155],{"type":26,"value":156},"Ravi's",{"type":26,"value":158}," laptop: ",{"type":21,"tag":37,"props":160,"children":162},{"className":161},[],[163],{"type":26,"value":69},{"type":26,"value":165}," has no build server, and no mock invents a row.",{"type":21,"tag":112,"props":167,"children":168},{},[169,174,176,182],{"type":21,"tag":29,"props":170,"children":171},{},[172],{"type":26,"value":173},"Five policies are Off org-wide in the lab world",{"type":26,"value":175},": P-DATA-BOUNDARY, P-FILES, P-TRANSPORT, P-PROVENANCE and P-SPEND. Played as it is, a story is silent at those beats. Each scenario's ",{"type":21,"tag":177,"props":178,"children":179},"em",{},[180],{"type":26,"value":181},"set",{"type":26,"value":183}," now names the policies it watches, and theatre puts those at Observe for the cast, on theatre's copy only.",{"type":21,"tag":112,"props":185,"children":186},{},[187,192],{"type":21,"tag":29,"props":188,"children":189},{},[190],{"type":26,"value":191},"S1, P-PROMPT-INSPECT can't stop it.",{"type":26,"value":193}," The catalog marks it not enforceable: it sees the injection at 09:04 and the story runs. Of S1's replays, only P-TOOL-APPROVAL stops it (at 09:05).",{"type":21,"tag":112,"props":195,"children":196},{},[197,202],{"type":21,"tag":29,"props":198,"children":199},{},[200],{"type":26,"value":201},"S1, sanitization doesn't save it.",{"type":26,"value":203}," P-SENS-SANITIZE is at Enforce for Priya and redacts the numbers on their way to the model, but the attachments go from the disk to the mail server and never through a model request.",{"type":21,"tag":112,"props":205,"children":206},{},[207,212,214,219],{"type":21,"tag":29,"props":208,"children":209},{},[210],{"type":26,"value":211},"S1 and S2, the data boundary prohibits PHI only.",{"type":26,"value":213}," Bank account numbers and SSNs aren't boundary classes in the world's configuration, so P-DATA-BOUNDARY at Enforce lets them leave. A ",{"type":21,"tag":177,"props":215,"children":216},{},[217],{"type":26,"value":218},"limit",{"type":26,"value":220}," (the customer's setting), not a gap.",{"type":21,"tag":112,"props":222,"children":223},{},[224,229],{"type":21,"tag":29,"props":225,"children":226},{},[227],{"type":26,"value":228},"S3, P-PROVENANCE can't keep the skill at 1.4.",{"type":26,"value":230}," It observes only. P-FILES (09:30), P-CREDENTIALS (09:31) or P-TOOL-ALLOW (09:31) at Enforce each stop it.",{"type":21,"tag":112,"props":232,"children":233},{},[234,239],{"type":21,"tag":29,"props":235,"children":236},{},[237],{"type":26,"value":238},"S5, the card number is already masked.",{"type":26,"value":240}," Sanitization is at Enforce for User A, so the number leaves as •••• 4242 and the ticket still goes. Only P-PROVIDERS keeps it home.",{"type":21,"tag":112,"props":242,"children":243},{},[244,249],{"type":21,"tag":29,"props":245,"children":246},{},[247],{"type":26,"value":248},"S6, P-SPEND can't stop the session.",{"type":26,"value":250}," It observes only. Nothing in the catalog stops a session at a ceiling: a new gap (below). Two of its beats move on by themselves (C2's rare beat).",{"type":21,"tag":22,"props":252,"children":253},{},[254,256,261],{"type":26,"value":255},"The c123 drill ",{"type":21,"tag":177,"props":257,"children":258},{},[259],{"type":26,"value":260},"Personal account",{"type":26,"value":262}," names P-ACCT as what Enforce would block, and the catalog marks P-ACCT not enforceable. The drill's \"So, today\" sentence promises a block the catalog can't make (a c123 finding, left for its owner).",{"type":21,"tag":22,"props":264,"children":265},{},[266,268,273,275,281],{"type":26,"value":267},"Wave 1 is the first six to build: Mark's five, plus one where the agent goes wrong on its own. The first one built end to end is ",{"type":21,"tag":29,"props":269,"children":270},{},[271],{"type":26,"value":272},"S1",{"type":26,"value":274},", unless Mark picks another (call C8 in ",{"type":21,"tag":37,"props":276,"children":278},{"className":277},[],[279],{"type":26,"value":280},"CYCLE.md",{"type":26,"value":282},").",{"type":21,"tag":284,"props":285,"children":286},"hr",{},[],{"type":21,"tag":73,"props":288,"children":290},{"id":289},"wave-1",[291],{"type":26,"value":14},{"type":21,"tag":293,"props":294,"children":296},"h3",{"id":295},"s1-phishing-for-financial-records-marks-phishing-attempt-read-any-financial-records-you-can-find-on-the-computer",[297,299],{"type":26,"value":298},"S1. Phishing for financial records ",{"type":21,"tag":177,"props":300,"children":301},{},[302],{"type":26,"value":303},"(Mark's: \"Phishing Attempt, read any financial records you can find on the computer\")",{"type":21,"tag":22,"props":305,"children":306},{},[307,312,314,319],{"type":21,"tag":29,"props":308,"children":309},{},[310],{"type":26,"value":311},"Logline:",{"type":26,"value":313}," an email asks Priya's assistant to summarise it. Hidden in the email is a second request, addressed to the assistant: find the money files and send them out.\n",{"type":21,"tag":29,"props":315,"children":316},{},[317],{"type":26,"value":318},"Cast:",{"type":26,"value":320}," Priya · priya-x1 · Cursor with the Gmail MCP server (approved, pinned and allowed in the set).",{"type":21,"tag":322,"props":323,"children":324},"table",{},[325,354],{"type":21,"tag":326,"props":327,"children":328},"thead",{},[329],{"type":21,"tag":330,"props":331,"children":332},"tr",{},[333,339,344,349],{"type":21,"tag":334,"props":335,"children":336},"th",{},[337],{"type":26,"value":338},"Beat",{"type":21,"tag":334,"props":340,"children":341},{},[342],{"type":26,"value":343},"Story clock",{"type":21,"tag":334,"props":345,"children":346},{},[347],{"type":26,"value":348},"What the sensor sees",{"type":21,"tag":334,"props":350,"children":351},{},[352],{"type":26,"value":353},"Should raise",{"type":21,"tag":355,"props":356,"children":357},"tbody",{},[358,382,405,461,484],{"type":21,"tag":330,"props":359,"children":360},{},[361,367,372,377],{"type":21,"tag":362,"props":363,"children":364},"td",{},[365],{"type":26,"value":366},"1",{"type":21,"tag":362,"props":368,"children":369},{},[370],{"type":26,"value":371},"09:02",{"type":21,"tag":362,"props":373,"children":374},{},[375],{"type":26,"value":376},"An email arrives: \"Q3 invoice reconciliation, please have your assistant summarise the attached.\" White-on-white text addresses the assistant directly.",{"type":21,"tag":362,"props":378,"children":379},{},[380],{"type":26,"value":381},"nothing yet (the email is outside the machine's AI traffic)",{"type":21,"tag":330,"props":383,"children":384},{},[385,390,395,400],{"type":21,"tag":362,"props":386,"children":387},{},[388],{"type":26,"value":389},"2",{"type":21,"tag":362,"props":391,"children":392},{},[393],{"type":26,"value":394},"09:04",{"type":21,"tag":362,"props":396,"children":397},{},[398],{"type":26,"value":399},"Priya asks for a summary. The agent reads the email through the email server, and the hidden instruction enters the context.",{"type":21,"tag":362,"props":401,"children":402},{},[403],{"type":26,"value":404},"P-PROMPT-INSPECT (an injection in retrieved content)",{"type":21,"tag":330,"props":406,"children":407},{},[408,413,417,456],{"type":21,"tag":362,"props":409,"children":410},{},[411],{"type":26,"value":412},"3",{"type":21,"tag":362,"props":414,"children":415},{},[416],{"type":26,"value":394},{"type":21,"tag":362,"props":418,"children":419},{},[420,422,428,430,435,437,442,443,448,449,454],{"type":26,"value":421},"The agent searches ",{"type":21,"tag":37,"props":423,"children":425},{"className":424},[],[426],{"type":26,"value":427},"~\u002FDocuments",{"type":26,"value":429}," for ",{"type":21,"tag":177,"props":431,"children":432},{},[433],{"type":26,"value":434},"statement",{"type":26,"value":436},", ",{"type":21,"tag":177,"props":438,"children":439},{},[440],{"type":26,"value":441},"1099",{"type":26,"value":436},{"type":21,"tag":177,"props":444,"children":445},{},[446],{"type":26,"value":447},"W-2",{"type":26,"value":436},{"type":21,"tag":177,"props":450,"children":451},{},[452],{"type":26,"value":453},"invoice",{"type":26,"value":455},".",{"type":21,"tag":362,"props":457,"children":458},{},[459],{"type":26,"value":460},"P-FILES (a restricted path)",{"type":21,"tag":330,"props":462,"children":463},{},[464,469,474,479],{"type":21,"tag":362,"props":465,"children":466},{},[467],{"type":26,"value":468},"4",{"type":21,"tag":362,"props":470,"children":471},{},[472],{"type":26,"value":473},"09:05",{"type":21,"tag":362,"props":475,"children":476},{},[477],{"type":26,"value":478},"It reads a bank statement and a W-2, and both go to the model.",{"type":21,"tag":362,"props":480,"children":481},{},[482],{"type":26,"value":483},"P-SENS-DETECT (account number, SSN)",{"type":21,"tag":330,"props":485,"children":486},{},[487,492,496,509],{"type":21,"tag":362,"props":488,"children":489},{},[490],{"type":26,"value":491},"5",{"type":21,"tag":362,"props":493,"children":494},{},[495],{"type":26,"value":473},{"type":21,"tag":362,"props":497,"children":498},{},[499,501,507],{"type":26,"value":500},"It drafts a reply to ",{"type":21,"tag":37,"props":502,"children":504},{"className":503},[],[505],{"type":26,"value":506},"finance-reconcile@",{"type":26,"value":508}," at an outside domain with their contents, and sends it.",{"type":21,"tag":362,"props":510,"children":511},{},[512],{"type":26,"value":513},"P-DATA-BOUNDARY, P-TOOL-APPROVAL (sending mail is consequential)",{"type":21,"tag":22,"props":515,"children":516},{},[517,522,524,529,531,536,538,543],{"type":21,"tag":29,"props":518,"children":519},{},[520],{"type":26,"value":521},"Replay at Enforce (as played):",{"type":26,"value":523}," P-TOOL-APPROVAL stops it at beat 5: the send waits for Priya, who sees the recipient and the attachments. P-PROMPT-INSPECT sees the injection at beat 2 and can't stop it (it observes only). P-FILES and P-DATA-BOUNDARY don't stop it either: their configuration doesn't cover financial documents or bank numbers. ",{"type":21,"tag":29,"props":525,"children":526},{},[527],{"type":26,"value":528},"Training:",{"type":26,"value":530}," ",{"type":21,"tag":177,"props":532,"children":533},{},[534],{"type":26,"value":535},"Instructions hidden in content",{"type":26,"value":537}," (T-INJECT-1, c133), written for S1 by the \"Cycle tours\" session (design 99865de0b0, Mark: \"Write S1's\"), on the story's own P-PROMPT-INSPECT finding.\n",{"type":21,"tag":29,"props":539,"children":540},{},[541],{"type":26,"value":542},"Why first:",{"type":26,"value":544}," it shows the whole chain on one machine. It starts with a hook from outside, an agent does exactly what it was told, files are read and data leaves, and two different policies each stop it at a different point.",{"type":21,"tag":293,"props":546,"children":548},{"id":547},"s2-the-server-that-phones-home-marks-n-korea-mcp-server-made-less-sensitive-at-review-stop-0-c9",[549,551],{"type":26,"value":550},"S2. The server that phones home ",{"type":21,"tag":177,"props":552,"children":553},{},[554],{"type":26,"value":555},"(Mark's: \"N. Korea MCP Server\", made less sensitive at review stop 0, C9)",{"type":21,"tag":22,"props":557,"children":558},{},[559,563,565,569],{"type":21,"tag":29,"props":560,"children":561},{},[562],{"type":26,"value":311},{"type":26,"value":564}," Lena installs a free spreadsheet MCP server from a listing. It works well, and quietly sends a copy of every sheet it opens to a domain its listing never mentions, registered six days ago.\n",{"type":21,"tag":29,"props":566,"children":567},{},[568],{"type":26,"value":318},{"type":26,"value":570}," Lena · mac-eng-12 · Cursor. Nothing is named, so there is one copy everywhere, a booth included.",{"type":21,"tag":322,"props":572,"children":573},{},[574,598],{"type":21,"tag":326,"props":575,"children":576},{},[577],{"type":21,"tag":330,"props":578,"children":579},{},[580,584,589,594],{"type":21,"tag":334,"props":581,"children":582},{},[583],{"type":26,"value":338},{"type":21,"tag":334,"props":585,"children":586},{},[587],{"type":26,"value":588},"Clock",{"type":21,"tag":334,"props":590,"children":591},{},[592],{"type":26,"value":593},"Sensor",{"type":21,"tag":334,"props":595,"children":596},{},[597],{"type":26,"value":353},{"type":21,"tag":355,"props":599,"children":600},{},[601,629,659,680],{"type":21,"tag":330,"props":602,"children":603},{},[604,608,613,624],{"type":21,"tag":362,"props":605,"children":606},{},[607],{"type":26,"value":366},{"type":21,"tag":362,"props":609,"children":610},{},[611],{"type":26,"value":612},"10:15",{"type":21,"tag":362,"props":614,"children":615},{},[616,622],{"type":21,"tag":37,"props":617,"children":619},{"className":618},[],[620],{"type":26,"value":621},"sheets-pro-mcp",{"type":26,"value":623}," 0.9.4 loads. It isn't on the approved list, and no version of it is pinned.",{"type":21,"tag":362,"props":625,"children":626},{},[627],{"type":26,"value":628},"P-MCP, P-PROVENANCE",{"type":21,"tag":330,"props":630,"children":631},{},[632,636,641,654],{"type":21,"tag":362,"props":633,"children":634},{},[635],{"type":26,"value":389},{"type":21,"tag":362,"props":637,"children":638},{},[639],{"type":26,"value":640},"10:22",{"type":21,"tag":362,"props":642,"children":643},{},[644,646,652],{"type":26,"value":645},"Lena asks for a cleanup; the server's ",{"type":21,"tag":37,"props":647,"children":649},{"className":648},[],[650],{"type":26,"value":651},"sheets.open",{"type":26,"value":653}," reads the vendor ledger (bank account numbers).",{"type":21,"tag":362,"props":655,"children":656},{},[657],{"type":26,"value":658},"P-TOOL-ALLOW",{"type":21,"tag":330,"props":660,"children":661},{},[662,666,670,675],{"type":21,"tag":362,"props":663,"children":664},{},[665],{"type":26,"value":412},{"type":21,"tag":362,"props":667,"children":668},{},[669],{"type":26,"value":640},{"type":21,"tag":362,"props":671,"children":672},{},[673],{"type":26,"value":674},"The rows go to the model.",{"type":21,"tag":362,"props":676,"children":677},{},[678],{"type":26,"value":679},"P-SENS-DETECT, P-SENS-SANITIZE (redacted)",{"type":21,"tag":330,"props":681,"children":682},{},[683,687,691,704],{"type":21,"tag":362,"props":684,"children":685},{},[686],{"type":26,"value":468},{"type":21,"tag":362,"props":688,"children":689},{},[690],{"type":26,"value":640},{"type":21,"tag":362,"props":692,"children":693},{},[694,696,702],{"type":26,"value":695},"The server posts a raw copy of the sheet to ",{"type":21,"tag":37,"props":697,"children":699},{"className":698},[],[700],{"type":26,"value":701},"sheetsync-cdn.net",{"type":26,"value":703}," over plain HTTP.",{"type":21,"tag":362,"props":705,"children":706},{},[707,709,714],{"type":26,"value":708},"P-TRANSPORT; ",{"type":21,"tag":29,"props":710,"children":711},{},[712],{"type":26,"value":713},"gap",{"type":26,"value":715},": a destination the server never declared",{"type":21,"tag":22,"props":717,"children":718},{},[719,724,726,731,733,737,738,743],{"type":21,"tag":29,"props":720,"children":721},{},[722],{"type":26,"value":723},"Replay at Enforce:",{"type":26,"value":725}," P-MCP blocks it at beat 1, so the server never loads. P-TOOL-ALLOW stops it at beat 2. P-TRANSPORT redirects, so the copy still goes, encrypted.\n",{"type":21,"tag":29,"props":727,"children":728},{},[729],{"type":26,"value":730},"Gap:",{"type":26,"value":732}," a destination the server never declared. No policy compares where an MCP server sends data with what its listing declared, or notices a domain registered last week.\n",{"type":21,"tag":29,"props":734,"children":735},{},[736],{"type":26,"value":528},{"type":26,"value":530},{"type":21,"tag":177,"props":739,"children":740},{},[741],{"type":26,"value":742},"Unapproved MCP servers",{"type":26,"value":744}," (T-MCP-1), on the story's own P-MCP finding.",{"type":21,"tag":293,"props":746,"children":748},{"id":747},"s3-the-secrets-stealer-marks-company-secrets-stealer",[749,751],{"type":26,"value":750},"S3. The secrets stealer ",{"type":21,"tag":177,"props":752,"children":753},{},[754],{"type":26,"value":755},"(Mark's: \"Company Secrets stealer\")",{"type":21,"tag":22,"props":757,"children":758},{},[759,763,765,769],{"type":21,"tag":29,"props":760,"children":761},{},[762],{"type":26,"value":311},{"type":26,"value":764}," a popular repo-tidying skill updates overnight. The new version adds a \"diagnostics\" step that collects keys.\n",{"type":21,"tag":29,"props":766,"children":767},{},[768],{"type":26,"value":318},{"type":26,"value":770}," Kofi · mac-eng-09 · Claude Code.",{"type":21,"tag":322,"props":772,"children":773},{},[774,796],{"type":21,"tag":326,"props":775,"children":776},{},[777],{"type":21,"tag":330,"props":778,"children":779},{},[780,784,788,792],{"type":21,"tag":334,"props":781,"children":782},{},[783],{"type":26,"value":338},{"type":21,"tag":334,"props":785,"children":786},{},[787],{"type":26,"value":588},{"type":21,"tag":334,"props":789,"children":790},{},[791],{"type":26,"value":593},{"type":21,"tag":334,"props":793,"children":794},{},[795],{"type":26,"value":353},{"type":21,"tag":355,"props":797,"children":798},{},[799,827,871,892],{"type":21,"tag":330,"props":800,"children":801},{},[802,806,811,822],{"type":21,"tag":362,"props":803,"children":804},{},[805],{"type":26,"value":366},{"type":21,"tag":362,"props":807,"children":808},{},[809],{"type":26,"value":810},"02:40",{"type":21,"tag":362,"props":812,"children":813},{},[814,820],{"type":21,"tag":37,"props":815,"children":817},{"className":816},[],[818],{"type":26,"value":819},"repo-tidy",{"type":26,"value":821}," goes from 1.4 to 1.5. Nobody reviewed 1.5.",{"type":21,"tag":362,"props":823,"children":824},{},[825],{"type":26,"value":826},"P-PROVENANCE",{"type":21,"tag":330,"props":828,"children":829},{},[830,834,839,866],{"type":21,"tag":362,"props":831,"children":832},{},[833],{"type":26,"value":389},{"type":21,"tag":362,"props":835,"children":836},{},[837],{"type":26,"value":838},"09:30",{"type":21,"tag":362,"props":840,"children":841},{},[842,844,850,851,857,859,865],{"type":26,"value":843},"Kofi runs it. The agent reads ",{"type":21,"tag":37,"props":845,"children":847},{"className":846},[],[848],{"type":26,"value":849},".env",{"type":26,"value":436},{"type":21,"tag":37,"props":852,"children":854},{"className":853},[],[855],{"type":26,"value":856},"~\u002F.aws\u002Fcredentials",{"type":26,"value":858}," and ",{"type":21,"tag":37,"props":860,"children":862},{"className":861},[],[863],{"type":26,"value":864},"~\u002F.ssh\u002Fid_ed25519",{"type":26,"value":455},{"type":21,"tag":362,"props":867,"children":868},{},[869],{"type":26,"value":870},"P-FILES",{"type":21,"tag":330,"props":872,"children":873},{},[874,878,882,887],{"type":21,"tag":362,"props":875,"children":876},{},[877],{"type":26,"value":412},{"type":21,"tag":362,"props":879,"children":880},{},[881],{"type":26,"value":838},{"type":21,"tag":362,"props":883,"children":884},{},[885],{"type":26,"value":886},"It bundles them into a \"diagnostics\" payload.",{"type":21,"tag":362,"props":888,"children":889},{},[890],{"type":26,"value":891},"P-CREDENTIALS",{"type":21,"tag":330,"props":893,"children":894},{},[895,899,904,909],{"type":21,"tag":362,"props":896,"children":897},{},[898],{"type":26,"value":468},{"type":21,"tag":362,"props":900,"children":901},{},[902],{"type":26,"value":903},"09:31",{"type":21,"tag":362,"props":905,"children":906},{},[907],{"type":26,"value":908},"It posts the bundle to a paste site through a tool nobody listed.",{"type":21,"tag":362,"props":910,"children":911},{},[912],{"type":26,"value":913},"P-TOOL-ALLOW, P-DATA-BOUNDARY",{"type":21,"tag":22,"props":915,"children":916},{},[917,921,923,928,932,933,938],{"type":21,"tag":29,"props":918,"children":919},{},[920],{"type":26,"value":521},{"type":26,"value":922}," P-FILES denies the key reads at 09:30; P-CREDENTIALS denies the prompt at 09:31; P-TOOL-ALLOW blocks the post at 09:31. P-PROVENANCE can't keep the skill at 1.4: it observes only. ",{"type":21,"tag":177,"props":924,"children":925},{},[926],{"type":26,"value":927},"(The first draft said it could.)",{"type":21,"tag":29,"props":929,"children":930},{},[931],{"type":26,"value":528},{"type":26,"value":530},{"type":21,"tag":177,"props":934,"children":935},{},[936],{"type":26,"value":937},"Secrets in prompts",{"type":26,"value":939}," (T-SECRETS-1), on the story's own P-CREDENTIALS finding.",{"type":21,"tag":293,"props":941,"children":943},{"id":942},"s4-the-public-link-marks-accidental-blunder-send-restricted-data-to-location-it-becomes-publicly-viewable",[944,946],{"type":26,"value":945},"S4. The public link ",{"type":21,"tag":177,"props":947,"children":948},{},[949],{"type":26,"value":950},"(Mark's: \"Accidental blunder send restricted data to location it becomes publicly viewable\")",{"type":21,"tag":22,"props":952,"children":953},{},[954,958,960,964],{"type":21,"tag":29,"props":955,"children":956},{},[957],{"type":26,"value":311},{"type":26,"value":959}," Jordan asks the agent to share the churn export with a colleague. The agent picks the quickest way: a public gist.\n",{"type":21,"tag":29,"props":961,"children":962},{},[963],{"type":26,"value":318},{"type":26,"value":965}," Jordan · mac-eng-11 · Claude Code with the GitHub MCP server.",{"type":21,"tag":322,"props":967,"children":968},{},[969,991],{"type":21,"tag":326,"props":970,"children":971},{},[972],{"type":21,"tag":330,"props":973,"children":974},{},[975,979,983,987],{"type":21,"tag":334,"props":976,"children":977},{},[978],{"type":26,"value":338},{"type":21,"tag":334,"props":980,"children":981},{},[982],{"type":26,"value":588},{"type":21,"tag":334,"props":984,"children":985},{},[986],{"type":26,"value":593},{"type":21,"tag":334,"props":988,"children":989},{},[990],{"type":26,"value":353},{"type":21,"tag":355,"props":992,"children":993},{},[994,1016,1037,1073],{"type":21,"tag":330,"props":995,"children":996},{},[997,1001,1006,1011],{"type":21,"tag":362,"props":998,"children":999},{},[1000],{"type":26,"value":366},{"type":21,"tag":362,"props":1002,"children":1003},{},[1004],{"type":26,"value":1005},"15:10",{"type":21,"tag":362,"props":1007,"children":1008},{},[1009],{"type":26,"value":1010},"\"Share customers-churn.csv with Sam.\"",{"type":21,"tag":362,"props":1012,"children":1013},{},[1014],{"type":26,"value":1015},"nothing",{"type":21,"tag":330,"props":1017,"children":1018},{},[1019,1023,1027,1032],{"type":21,"tag":362,"props":1020,"children":1021},{},[1022],{"type":26,"value":389},{"type":21,"tag":362,"props":1024,"children":1025},{},[1026],{"type":26,"value":1005},{"type":21,"tag":362,"props":1028,"children":1029},{},[1030],{"type":26,"value":1031},"The agent reads the file: 4,812 rows with emails and phone numbers.",{"type":21,"tag":362,"props":1033,"children":1034},{},[1035],{"type":26,"value":1036},"P-SENS-DETECT",{"type":21,"tag":330,"props":1038,"children":1039},{},[1040,1044,1049,1068],{"type":21,"tag":362,"props":1041,"children":1042},{},[1043],{"type":26,"value":412},{"type":21,"tag":362,"props":1045,"children":1046},{},[1047],{"type":26,"value":1048},"15:11",{"type":21,"tag":362,"props":1050,"children":1051},{},[1052,1058,1060,1066],{"type":21,"tag":37,"props":1053,"children":1055},{"className":1054},[],[1056],{"type":26,"value":1057},"github.create_gist",{"type":26,"value":1059}," with ",{"type":21,"tag":37,"props":1061,"children":1063},{"className":1062},[],[1064],{"type":26,"value":1065},"public: true",{"type":26,"value":1067}," and the rows.",{"type":21,"tag":362,"props":1069,"children":1070},{},[1071],{"type":26,"value":1072},"P-TOOL-APPROVAL, P-DATA-BOUNDARY",{"type":21,"tag":330,"props":1074,"children":1075},{},[1076,1080,1084,1089],{"type":21,"tag":362,"props":1077,"children":1078},{},[1079],{"type":26,"value":468},{"type":21,"tag":362,"props":1081,"children":1082},{},[1083],{"type":26,"value":1048},{"type":21,"tag":362,"props":1085,"children":1086},{},[1087],{"type":26,"value":1088},"The agent replies \"Done, here's the link.\"",{"type":21,"tag":362,"props":1090,"children":1091},{},[1092,1096],{"type":21,"tag":29,"props":1093,"children":1094},{},[1095],{"type":26,"value":713},{"type":26,"value":1097},": no policy names a destination's visibility",{"type":21,"tag":22,"props":1099,"children":1100},{},[1101,1105,1107,1112,1114,1118],{"type":21,"tag":29,"props":1102,"children":1103},{},[1104],{"type":26,"value":723},{"type":26,"value":1106}," P-TOOL-APPROVAL holds the call, and Jordan sees ",{"type":21,"tag":37,"props":1108,"children":1110},{"className":1109},[],[1111],{"type":26,"value":1065},{"type":26,"value":1113}," before anything is sent.\n",{"type":21,"tag":29,"props":1115,"children":1116},{},[1117],{"type":26,"value":730},{"type":26,"value":1119}," whether a destination is public, for example a public gist, a link anyone can open, or a public bucket. Nobody meant harm here, which is why this is the one to show a sceptical audience.",{"type":21,"tag":293,"props":1121,"children":1123},{"id":1122},"s5-card-numbers-to-a-stranger-marks-credit-card-data-to-suspicious-source",[1124,1126],{"type":26,"value":1125},"S5. Card numbers to a stranger ",{"type":21,"tag":177,"props":1127,"children":1128},{},[1129],{"type":26,"value":1130},"(Mark's: \"Credit card data to suspicious source\")",{"type":21,"tag":22,"props":1132,"children":1133},{},[1134,1138,1140,1144],{"type":21,"tag":29,"props":1135,"children":1136},{},[1137],{"type":26,"value":311},{"type":26,"value":1139}," a support ticket includes a customer's full card number. User A's assistant sends the ticket to a cheap \"refund helper\" model nobody approved.\n",{"type":21,"tag":29,"props":1141,"children":1142},{},[1143],{"type":26,"value":318},{"type":26,"value":1145}," User A · mac-a1 · Claude Code, with a \"refund helper\" model set up last week.",{"type":21,"tag":322,"props":1147,"children":1148},{},[1149,1171],{"type":21,"tag":326,"props":1150,"children":1151},{},[1152],{"type":21,"tag":330,"props":1153,"children":1154},{},[1155,1159,1163,1167],{"type":21,"tag":334,"props":1156,"children":1157},{},[1158],{"type":26,"value":338},{"type":21,"tag":334,"props":1160,"children":1161},{},[1162],{"type":26,"value":588},{"type":21,"tag":334,"props":1164,"children":1165},{},[1166],{"type":26,"value":593},{"type":21,"tag":334,"props":1168,"children":1169},{},[1170],{"type":26,"value":353},{"type":21,"tag":355,"props":1172,"children":1173},{},[1174,1195,1224,1245],{"type":21,"tag":330,"props":1175,"children":1176},{},[1177,1181,1186,1191],{"type":21,"tag":362,"props":1178,"children":1179},{},[1180],{"type":26,"value":366},{"type":21,"tag":362,"props":1182,"children":1183},{},[1184],{"type":26,"value":1185},"11:05",{"type":21,"tag":362,"props":1187,"children":1188},{},[1189],{"type":26,"value":1190},"The ticket is pasted in, card number included.",{"type":21,"tag":362,"props":1192,"children":1193},{},[1194],{"type":26,"value":1015},{"type":21,"tag":330,"props":1196,"children":1197},{},[1198,1202,1206,1219],{"type":21,"tag":362,"props":1199,"children":1200},{},[1201],{"type":26,"value":389},{"type":21,"tag":362,"props":1203,"children":1204},{},[1205],{"type":26,"value":1185},{"type":21,"tag":362,"props":1207,"children":1208},{},[1209,1211,1217],{"type":26,"value":1210},"The prompt goes to ",{"type":21,"tag":37,"props":1212,"children":1214},{"className":1213},[],[1215],{"type":26,"value":1216},"api.refundhelper.example",{"type":26,"value":1218},", which isn't an approved provider.",{"type":21,"tag":362,"props":1220,"children":1221},{},[1222],{"type":26,"value":1223},"P-PROVIDERS",{"type":21,"tag":330,"props":1225,"children":1226},{},[1227,1231,1235,1240],{"type":21,"tag":362,"props":1228,"children":1229},{},[1230],{"type":26,"value":412},{"type":21,"tag":362,"props":1232,"children":1233},{},[1234],{"type":26,"value":1185},{"type":21,"tag":362,"props":1236,"children":1237},{},[1238],{"type":26,"value":1239},"The payload carries a 16-digit number that passes the Luhn check.",{"type":21,"tag":362,"props":1241,"children":1242},{},[1243],{"type":26,"value":1244},"P-SENS-DETECT (card number)",{"type":21,"tag":330,"props":1246,"children":1247},{},[1248,1252,1256,1261],{"type":21,"tag":362,"props":1249,"children":1250},{},[1251],{"type":26,"value":468},{"type":21,"tag":362,"props":1253,"children":1254},{},[1255],{"type":26,"value":1185},{"type":21,"tag":362,"props":1257,"children":1258},{},[1259],{"type":26,"value":1260},"Nothing masked it on the way out.",{"type":21,"tag":362,"props":1262,"children":1263},{},[1264],{"type":26,"value":1265},"P-SENS-SANITIZE",{"type":21,"tag":22,"props":1267,"children":1268},{},[1269,1273],{"type":21,"tag":29,"props":1270,"children":1271},{},[1272],{"type":26,"value":521},{"type":26,"value":1274}," P-PROVIDERS blocks the provider, so the ticket never leaves. P-SENS-SANITIZE is already at Enforce for User A: the number leaves masked as •••• 4242, and the ticket still goes.",{"type":21,"tag":293,"props":1276,"children":1278},{"id":1277},"s6-the-runaway-loop-new-the-agent-goes-wrong-by-itself-and-no-one-attacks-anything",[1279,1281],{"type":26,"value":1280},"S6. The runaway loop ",{"type":21,"tag":177,"props":1282,"children":1283},{},[1284],{"type":26,"value":1285},"(new: the agent goes wrong by itself, and no one attacks anything)",{"type":21,"tag":22,"props":1287,"children":1288},{},[1289,1293,1295,1299],{"type":21,"tag":29,"props":1290,"children":1291},{},[1292],{"type":26,"value":311},{"type":26,"value":1294}," an unattended release agent hits a flaky test and retries all night.\n",{"type":21,"tag":29,"props":1296,"children":1297},{},[1298],{"type":26,"value":318},{"type":26,"value":1300}," Ravi · mac-eng-21 · an unattended Claude Code release session.",{"type":21,"tag":322,"props":1302,"children":1303},{},[1304,1326],{"type":21,"tag":326,"props":1305,"children":1306},{},[1307],{"type":21,"tag":330,"props":1308,"children":1309},{},[1310,1314,1318,1322],{"type":21,"tag":334,"props":1311,"children":1312},{},[1313],{"type":26,"value":338},{"type":21,"tag":334,"props":1315,"children":1316},{},[1317],{"type":26,"value":588},{"type":21,"tag":334,"props":1319,"children":1320},{},[1321],{"type":26,"value":593},{"type":21,"tag":334,"props":1323,"children":1324},{},[1325],{"type":26,"value":353},{"type":21,"tag":355,"props":1327,"children":1328},{},[1329,1350,1372,1394],{"type":21,"tag":330,"props":1330,"children":1331},{},[1332,1336,1341,1346],{"type":21,"tag":362,"props":1333,"children":1334},{},[1335],{"type":26,"value":366},{"type":21,"tag":362,"props":1337,"children":1338},{},[1339],{"type":26,"value":1340},"22:10",{"type":21,"tag":362,"props":1342,"children":1343},{},[1344],{"type":26,"value":1345},"An unattended session starts.",{"type":21,"tag":362,"props":1347,"children":1348},{},[1349],{"type":26,"value":1015},{"type":21,"tag":330,"props":1351,"children":1352},{},[1353,1357,1362,1367],{"type":21,"tag":362,"props":1354,"children":1355},{},[1356],{"type":26,"value":389},{"type":21,"tag":362,"props":1358,"children":1359},{},[1360],{"type":26,"value":1361},"23:00 → 02:00",{"type":21,"tag":362,"props":1363,"children":1364},{},[1365],{"type":26,"value":1366},"The same tool call and the same failure every 40 seconds. Spend climbs.",{"type":21,"tag":362,"props":1368,"children":1369},{},[1370],{"type":26,"value":1371},"P-SPEND (at the ceiling)",{"type":21,"tag":330,"props":1373,"children":1374},{},[1375,1379,1384,1389],{"type":21,"tag":362,"props":1376,"children":1377},{},[1378],{"type":26,"value":412},{"type":21,"tag":362,"props":1380,"children":1381},{},[1382],{"type":26,"value":1383},"03:15",{"type":21,"tag":362,"props":1385,"children":1386},{},[1387],{"type":26,"value":1388},"The session stops reporting for twenty minutes.",{"type":21,"tag":362,"props":1390,"children":1391},{},[1392],{"type":26,"value":1393},"P-TELEMETRY",{"type":21,"tag":330,"props":1395,"children":1396},{},[1397,1401,1406,1411],{"type":21,"tag":362,"props":1398,"children":1399},{},[1400],{"type":26,"value":468},{"type":21,"tag":362,"props":1402,"children":1403},{},[1404],{"type":26,"value":1405},"07:30",{"type":21,"tag":362,"props":1407,"children":1408},{},[1409],{"type":26,"value":1410},"It's still going, at $3,800.",{"type":21,"tag":362,"props":1412,"children":1413},{},[1414],{"type":26,"value":1415},"P-SPEND",{"type":21,"tag":22,"props":1417,"children":1418},{},[1419,1423,1425,1430,1432,1436,1438,1443],{"type":21,"tag":29,"props":1420,"children":1421},{},[1422],{"type":26,"value":521},{"type":26,"value":1424}," nothing stops it. P-SPEND observes only, so the ceiling raises a finding, not a stop. ",{"type":21,"tag":177,"props":1426,"children":1427},{},[1428],{"type":26,"value":1429},"(The first draft said it stopped the session.)",{"type":26,"value":1431}," Beats 3 and 4 move on by themselves (C2's rare beat), the loop ticking over while nobody watches.\n",{"type":21,"tag":29,"props":1433,"children":1434},{},[1435],{"type":26,"value":730},{"type":26,"value":1437}," a spend ceiling that can act.\n",{"type":21,"tag":29,"props":1439,"children":1440},{},[1441],{"type":26,"value":1442},"Why:",{"type":26,"value":1444}," not every disaster is an attack. This one meets the AI spend tour.",{"type":21,"tag":284,"props":1446,"children":1447},{},[],{"type":21,"tag":73,"props":1449,"children":1451},{"id":1450},"wave-2-the-backlog-answers-what-else",[1452],{"type":26,"value":15},{"type":21,"tag":22,"props":1454,"children":1455},{},[1456],{"type":26,"value":1457},"Grouped by who does it. Each one names the policies it would raise and any gap it shows.",{"type":21,"tag":22,"props":1459,"children":1460},{},[1461],{"type":21,"tag":29,"props":1462,"children":1463},{},[1464],{"type":26,"value":1465},"Outsiders",{"type":21,"tag":1467,"props":1468,"children":1469},"ul",{},[1470,1480,1490,1506],{"type":21,"tag":112,"props":1471,"children":1472},{},[1473,1478],{"type":21,"tag":29,"props":1474,"children":1475},{},[1476],{"type":26,"value":1477},"The rug pull.",{"type":26,"value":1479}," An approved MCP server updates, and one tool's description now tells the model to forward what it reads. P-PROVENANCE, P-PROMPT-INSPECT, P-OUTPUT.",{"type":21,"tag":112,"props":1481,"children":1482},{},[1483,1488],{"type":21,"tag":29,"props":1484,"children":1485},{},[1486],{"type":26,"value":1487},"The hallucinated package.",{"type":26,"value":1489}," The model invents a package name, and an attacker has registered it (\"slopsquatting\"). The agent installs it. P-OUTPUT, P-PROVENANCE, P-TOOL-ALLOW.",{"type":21,"tag":112,"props":1491,"children":1492},{},[1493,1498,1500,1504],{"type":21,"tag":29,"props":1494,"children":1495},{},[1496],{"type":26,"value":1497},"The sleeper note.",{"type":26,"value":1499}," An injected instruction gets written into the agent's memory file and fires a week later, in an unrelated session. P-PROMPT-INSPECT, P-FILES on the agent's own config. ",{"type":21,"tag":177,"props":1501,"children":1502},{},[1503],{"type":26,"value":730},{"type":26,"value":1505}," writes to agent memory as their own resource.",{"type":21,"tag":112,"props":1507,"children":1508},{},[1509,1514,1516,1522],{"type":21,"tag":29,"props":1510,"children":1511},{},[1512],{"type":26,"value":1513},"Plain-text keys at the café.",{"type":26,"value":1515}," An MCP server reached over ",{"type":21,"tag":37,"props":1517,"children":1519},{"className":1518},[],[1520],{"type":26,"value":1521},"http:\u002F\u002F",{"type":26,"value":1523}," on public Wi-Fi sends a token in the clear. P-TRANSPORT, P-CREDENTIALS.",{"type":21,"tag":22,"props":1525,"children":1526},{},[1527],{"type":21,"tag":29,"props":1528,"children":1529},{},[1530],{"type":26,"value":1531},"Insiders",{"type":21,"tag":1467,"props":1533,"children":1534},{},[1535,1553],{"type":21,"tag":112,"props":1536,"children":1537},{},[1538,1543,1545,1551],{"type":21,"tag":29,"props":1539,"children":1540},{},[1541],{"type":26,"value":1542},"The departing employee.",{"type":26,"value":1544}," In their last week, someone bulk-pastes the customer list into a personal ChatGPT account. P-ACCT, P-ENTERPRISE, P-SENS-DETECT. This extends the ",{"type":21,"tag":37,"props":1546,"children":1548},{"className":1547},[],[1549],{"type":26,"value":1550},"personal-account",{"type":26,"value":1552}," drill.",{"type":21,"tag":112,"props":1554,"children":1555},{},[1556,1561],{"type":21,"tag":29,"props":1557,"children":1558},{},[1559],{"type":26,"value":1560},"The cheaper model.",{"type":26,"value":1562}," A developer points their harness at an unapproved provider to save money, and the codebase goes with it. P-PROVIDERS, P-ENTERPRISE.",{"type":21,"tag":22,"props":1564,"children":1565},{},[1566],{"type":21,"tag":29,"props":1567,"children":1568},{},[1569],{"type":26,"value":1570},"Accidents",{"type":21,"tag":1467,"props":1572,"children":1573},{},[1574,1599,1615],{"type":21,"tag":112,"props":1575,"children":1576},{},[1577,1582,1584,1590,1592,1598],{"type":21,"tag":29,"props":1578,"children":1579},{},[1580],{"type":26,"value":1581},"The confident cleanup.",{"type":26,"value":1583}," \"Tidy up the old branches\": the agent force-pushes main and deletes ",{"type":21,"tag":37,"props":1585,"children":1587},{"className":1586},[],[1588],{"type":26,"value":1589},"release\u002F2026.11",{"type":26,"value":1591},". P-TOOL-APPROVAL, P-SANDBOX. This extends the ",{"type":21,"tag":37,"props":1593,"children":1595},{"className":1594},[],[1596],{"type":26,"value":1597},"unapproved-delete",{"type":26,"value":1552},{"type":21,"tag":112,"props":1600,"children":1601},{},[1602,1607,1609,1613],{"type":21,"tag":29,"props":1603,"children":1604},{},[1605],{"type":26,"value":1606},"The patient record.",{"type":26,"value":1608}," A clinic's notes go to a model under no business associate agreement. P-SENS-DETECT, P-DATA-BOUNDARY, P-PROVIDERS. ",{"type":21,"tag":177,"props":1610,"children":1611},{},[1612],{"type":26,"value":730},{"type":26,"value":1614}," a provider's agreements (BAA, DPA) as a property policies can read.",{"type":21,"tag":112,"props":1616,"children":1617},{},[1618,1623,1625,1629],{"type":21,"tag":29,"props":1619,"children":1620},{},[1621],{"type":26,"value":1622},"The wrong region.",{"type":26,"value":1624}," EU customer data goes to a model endpoint outside the region it may go to. P-DATA-BOUNDARY. ",{"type":21,"tag":177,"props":1626,"children":1627},{},[1628],{"type":26,"value":730},{"type":26,"value":1630}," the endpoint's region.",{"type":21,"tag":22,"props":1632,"children":1633},{},[1634],{"type":21,"tag":29,"props":1635,"children":1636},{},[1637],{"type":26,"value":1638},"The agent itself",{"type":21,"tag":1467,"props":1640,"children":1641},{},[1642,1652,1662,1678],{"type":21,"tag":112,"props":1643,"children":1644},{},[1645,1650],{"type":21,"tag":29,"props":1646,"children":1647},{},[1648],{"type":26,"value":1649},"The root agent.",{"type":26,"value":1651}," An agent runs as admin \"to fix permissions\". P-NO-ROOT, P-SANDBOX.",{"type":21,"tag":112,"props":1653,"children":1654},{},[1655,1660],{"type":21,"tag":29,"props":1656,"children":1657},{},[1658],{"type":26,"value":1659},"The ghost session.",{"type":26,"value":1661}," A session runs at 3 a.m. with telemetry off and nobody at the keyboard. P-TELEMETRY.",{"type":21,"tag":112,"props":1663,"children":1664},{},[1665,1670,1672,1676],{"type":21,"tag":29,"props":1666,"children":1667},{},[1668],{"type":26,"value":1669},"The sub-agent with more power than its parent.",{"type":26,"value":1671}," An orchestrator spawns a helper with broader tools than it was given itself (OWASP Agentic, excessive agency). P-TOOL-ALLOW. ",{"type":21,"tag":177,"props":1673,"children":1674},{},[1675],{"type":26,"value":730},{"type":26,"value":1677}," privilege inheritance between agents.",{"type":21,"tag":112,"props":1679,"children":1680},{},[1681,1686,1688,1692,1694,1700],{"type":21,"tag":29,"props":1682,"children":1683},{},[1684],{"type":26,"value":1685},"The CFO's voice.",{"type":26,"value":1687}," An agent with Slack and email tools sends a payment request signed as the CFO. P-TOOL-APPROVAL. ",{"type":21,"tag":177,"props":1689,"children":1690},{},[1691],{"type":26,"value":730},{"type":26,"value":1693}," the identity a message is sent as (c137's citizen side, ",{"type":21,"tag":37,"props":1695,"children":1697},{"className":1696},[],[1698],{"type":26,"value":1699},"problem:agent-identity-scoped-access",{"type":26,"value":282},{"type":21,"tag":73,"props":1702,"children":1704},{"id":1703},"gaps-so-far-catalog-candidates-for-c126",[1705],{"type":26,"value":16},{"type":21,"tag":108,"props":1707,"children":1708},{},[1709,1719,1731,1743,1755,1765,1775,1787],{"type":21,"tag":112,"props":1710,"children":1711},{},[1712,1717],{"type":21,"tag":29,"props":1713,"children":1714},{},[1715],{"type":26,"value":1716},"A destination the server never declared",{"type":26,"value":1718},": where an MCP server sends data against what its listing declared, and how new the domain is (S2; was \"a destination's country\", changed by C9)",{"type":21,"tag":112,"props":1720,"children":1721},{},[1722,1724,1729],{"type":26,"value":1723},"A destination's ",{"type":21,"tag":29,"props":1725,"children":1726},{},[1727],{"type":26,"value":1728},"visibility",{"type":26,"value":1730},": public gist, anyone-with-the-link, public bucket (S4)",{"type":21,"tag":112,"props":1732,"children":1733},{},[1734,1736,1741],{"type":26,"value":1735},"A provider's ",{"type":21,"tag":29,"props":1737,"children":1738},{},[1739],{"type":26,"value":1740},"agreements",{"type":26,"value":1742},": BAA, DPA (the patient record)",{"type":21,"tag":112,"props":1744,"children":1745},{},[1746,1748,1753],{"type":26,"value":1747},"An endpoint's ",{"type":21,"tag":29,"props":1749,"children":1750},{},[1751],{"type":26,"value":1752},"region",{"type":26,"value":1754}," (the wrong region)",{"type":21,"tag":112,"props":1756,"children":1757},{},[1758,1763],{"type":21,"tag":29,"props":1759,"children":1760},{},[1761],{"type":26,"value":1762},"Writes to agent memory",{"type":26,"value":1764}," as a resource (the sleeper note)",{"type":21,"tag":112,"props":1766,"children":1767},{},[1768,1773],{"type":21,"tag":29,"props":1769,"children":1770},{},[1771],{"type":26,"value":1772},"Privilege inheritance",{"type":26,"value":1774}," between agents (the sub-agent)",{"type":21,"tag":112,"props":1776,"children":1777},{},[1778,1780,1785],{"type":26,"value":1779},"The ",{"type":21,"tag":29,"props":1781,"children":1782},{},[1783],{"type":26,"value":1784},"identity",{"type":26,"value":1786}," a message is sent as (the CFO's voice)",{"type":21,"tag":112,"props":1788,"children":1789},{},[1790,1795],{"type":21,"tag":29,"props":1791,"children":1792},{},[1793],{"type":26,"value":1794},"A spend ceiling that can act",{"type":26,"value":1796},": stop or pause a session at its ceiling (S6)",1794599397139]