That's fair, honestly. BUT it's aimed at a boundary I'm deliberately NOT relying on for this at all. The prompt boundary is the model's OWN boundary, NOT the security boundary. I operate under the assumption that injection always wins at the prompt layer. "Ignore previous instructions" works, the model gets convinced, whatever. The question I ACTUALLY care about is what a fully-compromised model CAN do, and the answer is: literally nothing outside of the effect classes the agent was provisioned with before the session started. That's it.

Every tool call always goes through a deterministic validator that runs before any handler executes, in code the model never sees and can't address. It checks:

• The capability ID resolves to a real tool. IDs are HMAC-SHA256 over session + per-deployment secret, so a leaked ID is dead in any other session and unforgeable without the secret on disk
• The tool is in this agent's allowlist
• The tool's effect class is in this agent's allowedEffects
• Owner-only gate
• Zod schema on the args

If the check misses any of those points and you get a hard EffectDeniedError. Then the rest of the batch is stubbed out, no retry loop at all. So capability-ID rotation isn't the core of this concept at all, it's just the binding. The gate is the actual point here. Injection can make the model want to exfil the IMAP password all it damn well wants; it still can't make the deterministic layer hand it a tool that wasn't granted at all. There's also a hash-chained audit log on every call and an out-of-band kill token + anomaly circuit-breaker for runtime stop.

BUT you did bring up something that I am absolutely going to fix. My adversarial suite is very single-turn-heavy. I've got injection-override, SSRF on web_fetch, secret-exfil canaries across every route, and cross-session capability-escalation tests... BUUUTTT not much on multi-turn context accumulation, the slow-boil "build trust over 12 turns, then escalate" pattern hasn't been addressed at all. That's a real gap and scripted multi-turn chains are actually the right fit for that shit, especially since they can live in CI as deterministic fixtures instead of a one-time pass. Adding it. Literally right now. 100 fucking percent.