Design lineage

The architecture assembles proven patterns rather than inventing new mechanisms. Each entry below names the prior art and where Interbolt departs from it.

• Enforcement core, modeled on Casbin. A pure check() entrypoint, analogous to Casbin's enforce(): given a request (tool, args, taint), evaluate a policy and return a decision. The divergence is the request itself. Casbin decides on subject, object, and action, all known to the caller; Interbolt's decisive input is the provenance of the arguments, which the caller never states and cannot forge.
• Policy language: CEL. The same expression language Kubernetes admission control uses, chosen so conditions are sandboxed, non-Turing-complete, and compiled once at load. A when: condition is plain CEL, using CEL's own macro set (exists for quantification), plus a compile-time expansion for require_endorsement; see Policy evaluation internals.
• Reporting, modeled on OpenTelemetry. A stable public surface that is inert by default, with swappable reporter implementations behind a protocol and an in-memory reporter for tests. Interbolt is an enforcement authority, so reporting is strictly an output: a reporter can never change or delay a decision, and there is no uninstrument(), since detaching a gate is an attack primitive where detaching an observer is harmless.
• Taint carrier, modeled on Django's SafeString / MarkupSafe. A str/bytes subclass that overrides dunder methods so taint propagates through a defined subset of string operations. The divergence: Interbolt carries a provenance set and resolves trust late, at the sink, where SafeString carries a two-state safe/unsafe bit that degrades on contact. Late resolution is what lets one labeled value be blocked at one sink and allowed at another under the same policy.
• Endorsement, modeled on Resin (Yip et al., SOSP 2009). Resin's declassifier policies are the closest prior art for endorse(): an explicit, auditable primitive that reduces a value's restrictiveness under a named policy, kept distinct from the tracking mechanism itself.

The one thing with no prior art to borrow is the honest limit that follows from an in-process string carrier: propagation is partial, and a model that paraphrases untrusted text launders the label. run.tainted exists as a coarse, run-scoped backstop for exactly that gap. See Taint propagation.