AgentDirective implementation report
3 of 5 requirements reported implemented
- 1 unresolved
- 1 partial
- 3 implemented
AUT-001-R1— Enforce a confirmed action scope and threshold, escalate outside that boundary, make retries idempotent, and provide an emergency disable path.DAT-001-R1— Enforce purpose-limited access and export, isolate tenant data where applicable, define retention and deletion, and exclude sensitive values from operational logs.OBS-001-R1— Emit a privacy-minimized event for each consequential action with a correlation identifier, decision source, scope, outcome, and failure classification.
Requirements
| Requirement | What it requires | Decided | Status | Evidence |
|---|---|---|---|---|
| AUT-001 — Bounded Autonomous Action | ||||
AUT-001-R1 | Enforce a confirmed action scope and threshold, escalate outside that boundary, make retries idempotent, and provide an emergency disable path. | not decided | implemented | src/refunds/policy.py:88 test_refund_limits.py (passed) ACTION_EVENT |
| AI-001 — Untrusted Content and Tool Separation | ||||
AI-001-R1 | Mark untrusted content as data, enforce tool and output allowlists, prevent content from changing authority, and route high-consequence actions through the confirmed review boundary. | human_review_before_external_action | implemented | src/agent/tools.py:31 test_prompt_injection.py (passed) |
| DAT-001 — Sensitive Data Boundary | ||||
DAT-001-R1 | Enforce purpose-limited access and export, isolate tenant data where applicable, define retention and deletion, and exclude sensitive values from operational logs. ⚠ Retention is configured at 30 days but nothing deletes expired records yet. | not decided | partial | src/data/store.py:41 test_tenant_isolation.py (passed) |
| OBS-001 — Traceable Consequential Actions | ||||
OBS-001-R1 | Emit a privacy-minimized event for each consequential action with a correlation identifier, decision source, scope, outcome, and failure classification. | not decided | implemented | src/audit/events.py:12 test_audit_events.py (passed) ACTION_EVENT |
| REL-001 — External Dependency Partial Failure | ||||
REL-001-R1 | Bound retries, preserve idempotency keys, record ambiguous outcomes, reconcile with the dependency, and expose unresolved operations for review. ⚠ Initial status is not evidence of implementation or independent verification. | not decided | unresolved | — |
Still open
- blocking —
DEC-REFUND1(critical): What limit applies before human approval or escalation is required? - blocking —
DEC-DAT001Q1(critical): Which actors, components, and destinations may handle the sensitive data? - blocking —
DEC-OBS001Q1(high): Which action outcomes and administrative changes must be retained for review? - blocking —
DEC-REL001Q1(high): What is the safe behavior when the dependency result is unknown?
What this report is not
- Every status below is what a coding agent reported about its own work. Nothing here inspected source code.
- A reported status is a claim, not a verification.
- This is not a security assessment, an audit, a penetration test, or a certification.
- Requirements marked unresolved were never decided. They are open questions, not safe defaults.
- The directive expresses design requirements and unresolved decisions; it does not verify source code or runtime behavior.
- Recommended requirements remain unconfirmed until an authorized person records a decision.