SECURITY BOUNDARY

Security boundary: what Stipul controls and what it does not

Stipul is a runtime authorization and audit layer for mediated AI agent tool calls. It controls calls routed through Writ. When a request passes through that boundary, the Charter is evaluated before execution, the decision is enforced, Chronicle records the mediated enforcement decision, and Seal verifies whether the evidence remains intact. Outside the Writ enforcement path, Stipul makes no claim.

The governed path for AI agent tool calls

INSIDE THE BOUNDARY

A tool call routed through Writ is evaluated against the Charter before execution. If allowed, Writ forwards the call and Chronicle records the decision. If denied, Writ does not forward the mediated call and Chronicle records the rule that triggered the denial.

OUTSIDE THE BOUNDARY

A direct API call, leaked credential, compromised host, unmanaged SDK call, or channel that bypasses Writ is outside Stipul's enforcement path. Stipul cannot authorize, deny, record, or verify actions it did not mediate.

What Stipul controls

  • Tool calls mediated through Writ.
  • Charter evaluation before external API execution.
  • ALLOW or DENY decisions for governed calls.
  • Whether denied mediated calls are forwarded through the Writ enforcement path.
  • Chronicle evidence for mediated enforcement decisions.
  • Seal verification for the recorded evidence chain.

What Stipul proves for mediated AI agent tool calls

For mediated calls routed through Writ, Stipul can show that a call was evaluated against the Charter in force, that the call was allowed or denied based on a recorded rule, that the decision was recorded in Chronicle, whether a denied call was forwarded through the Writ enforcement path, and whether the recorded evidence chain has been modified since the Seal was created.

What Stipul does not control

Direct API access that bypasses Writ.

If an agent or user calls a third-party API without routing through Writ, Stipul has no visibility and no enforcement.

Leaked credentials.

If credentials are compromised and used outside the governed workflow, Stipul cannot prevent or detect that usage.

Compromised hosts.

If the machine running Writ is compromised, the enforcement boundary is compromised with it.

Unmanaged SDK calls.

If an agent framework makes tool calls through a path that does not route through Writ, those calls are ungoverned.

Incorrect Charters.

Stipul enforces the Charter as written. If the policy permits something it should not, Stipul will allow it. Charter correctness is the operator's responsibility.

Actions outside the governed workflow.

Stipul governs what it mediates. Anything that happens through other channels is outside scope.

What Stipul does not prove

Stipul does not prove that no other action occurred outside Writ.

Stipul does not prove the Charter was correct.

Stipul does not prove the agent behaved well.

Stipul does not prove that a specific enterprise identity produced the record unless that identity is bound by the deployment.

Stipul does not prove third-party API state after an allowed forwarded call.

Roadmap items, not current claims

Origin binding.

The current trust model proves evidence integrity, not full enterprise origin. Stronger signing identity, credential custody, and enterprise attestation remain roadmap items.

External timestamping.

Cryptographic proof that a session existed at a specific point in time, anchored to an independent authority.

Charter validation.

Tooling to verify that a Charter covers the intended scope and does not contain unintended permissions.

Multi-party verification.

Allowing independent parties to verify Chronicle integrity without trusting the operator.

Credential custody.

Keeping real downstream platform credentials behind Writ instead of inside the agent runtime.

Bypass prevention.

Deployment controls that reduce unmanaged paths around Writ.

Why this page exists

Governance that claims completeness is less trustworthy than governance that defines its edges. This page defines Stipul's current security boundary. If a limitation is not listed here, it is either covered by the architecture or it is an unknown we have not yet identified.

If you find one, contact [email protected].