Glossary

• Approval resolver: the callable invoked on a require_approval decision, returning True to allow the call or False to deny it. The default denies every request. See API reference.
• Capability: a declared property of a tool, either reads_private or reaches_external, set with the capabilities: key on a sink entry. Capabilities are what make two of the three lethal-trifecta legs computable. See Policies: declaring what a tool does.
• Confused deputy: an agent tricked by untrusted input into misusing its own legitimate authority, for example a model that reads an attacker's instructions embedded in a document and then calls a privileged tool on the attacker's behalf. endorse() is restricted to deterministic code for this reason: a model's own assessment of a value cannot be trusted to vouch for it. See Auditing: endorsement.
• Decision: the allow/block/require_approval result check() computes for a guarded call, including which rule matched and why. See API reference.
• Derivation hop: a taint(value, source=..., derived_from=[...]) call marking a value as derived from others, so trust is inherited from the inputs rather than assumed. The shape track_model_call wraps. See Model calls and derived values.
• Endorsement: an explicit, audited mark (endorse(value, kind=...)) that a value was validated for a specific purpose, without erasing its lineage or changing how its trust resolves. See Auditing: endorsement.
• Envelope: the versioned, JSON-representable dict pack() returns and unpack() consumes, carrying a value's stripped payload alongside its provenance sidecar. See Serialization.
• Event: the versioned record emitted through a reporter for every guarded call, wrapping the Decision. See Events.
• Fail-closed / fail-open: whether an evaluation error blocks the call (fail-closed, the enforce default) or lets it proceed (fail-open, monitor). Under dry_run every decision is computed and then downgraded to allow. See Policies: modes.
• Finding: the record emitted when the laundering audit sees untrusted content reach a sink argument with no label. See Auditing.
• Guard: the @guard decorator that evaluates policy before a tool function runs, blocking, allowing, or routing to approval. See Writing a policy.
• Ingested by (ingested_by): the de-duplicated set of agent ids that ingested or derived a value, distinct from lineage (which names sources, not agents) and from agent.id (which names the agent calling now, not the one that brought the data in). Ingress and derivation attribution, not a full custody chain: a plain hand-off with no re-taint leaves no entry. See How trust is decided.
• Integrity dual of declassification: the relationship between taint() and endorse(). Declassification lowers a value's confidentiality label so it can flow somewhere new; endorse() instead raises a value's integrity by recording that a specific check vouched for it, without erasing where it came from or changing how its trust resolves. See Auditing: endorsement.
• Label: the object a tainted value carries, holding source, value_id, lineage, ingested_by, and endorsements. See How trust is decided.
• Laundering: an operation that silently drops a taint label, such as an f-string with literal text, str.format on a plain template, or join on a plain separator. See What survives, in practice.
• Lethal trifecta: the attack pattern of an agent that reads untrusted data, has access to private data, and can exfiltrate, all at once. See Threat model.
• Namespace: the first half of a sink's dotted qualified name, scoping tool identity so two tools in different namespaces can never collide. See Policies: namespacing.
• Provenance / lineage: the de-duplicated set of every source name that contributed to a value, and the basis for trust resolution at the sink, rather than a single trusted/untrusted bit. See How trust is decided.
• Reporter: the seam every emitted record leaves through, swappable and inert by default. See Reporters.
• Rule of Two: the posture of blocking a call when all three lethal-trifecta legs are present in a run, written as size(run.trifecta) >= 3. See Policies: the Rule-of-Two check.
• Run (run_id): one unit of agent activity, minted once at agent_context entry and shared by every guarded call inside it, even across multiple agents. See Identity.
• Run-level gating (run.tainted): a policy signal that is true once anything untrusted has entered the run, surviving the laundering that destroys a value-level label. See Policies: run-level gating.
• Session (session_id): an optional, integrator-supplied id spanning multiple runs in a multi-turn conversation, set only through an explicit check() call. See Identity.
• Sidecar: the path-keyed list of label and shape entries pack() records alongside a stripped payload, letting unpack() rebuild every carrier without touching the payload's own bytes. See Serialization.
• Sink: the guarded call boundary where check() runs and a decision is made, keyed in a policy as a dotted namespace.tool name. Every guarded call is a sink, a read included, which is why a tool that only reads data still gets an entry under sinks:. See Policies: sinks and rules.
• Source: a named origin of ingress data, declared in a policy's sources table with a trust level. An undeclared source resolves untrusted. See Policies: sources.
• Taint: the mark applied by taint(value, source=...) recording where a value came from. See Taint propagation.
• Trust resolution: determining whether a value counts as trusted or untrusted, done late, at the sink, by checking every name in its lineage against the policy's sources table, untrusted-wins. See Policies: evaluation semantics.