I work on keeping AI agents cheap and reliable in production — token cost (FinOps), evals, and MCP tooling. I write up what actually breaks when agents run for real: runnable code, real numbers, hones
Work
Independent — AI agent operations (FinOps & reliability)
Twenty days late, and there's no excuse for that — sorry.
Your runtime point made me go re-run the gate rather than just agree with it, and the result was not what I expected. I tagged the same three-tool manifest two ways:
http_fetch declared can_egress only (the under-tagged case you describe):
Same verdict, same exit 1. In the default shared_context mode a mid-session capability flip cannot produce a false pass, because the gate never reasons about values at all — it puts every non-isolated tool on one context bus and assumes maximal composition. Under-tagging a dual-role tool costs you path count, not the verdict.
Which reframes what taint-tracking would buy there: precision, not safety. It would tell you which of those two paths is actually live this session, instead of blocking on both. Useful for triage, not for the block decision.
The place where taint-tracking would buy real safety is the other mode — data_flow: "explicit", where only declared edges carry taint and one unenumerated composition edge is a silent clean pass. That's the actual hole, and it lives in the declaration rather than the runtime.
For further actions, you may consider blocking this person and/or reporting abuse
We're a place where coders share, stay up-to-date and grow their careers.
Twenty days late, and there's no excuse for that — sorry.
Your runtime point made me go re-run the gate rather than just agree with it, and the result was not what I expected. I tagged the same three-tool manifest two ways:
http_fetchdeclaredcan_egressonly (the under-tagged case you describe):http_fetchdeclaredcan_egress+ingests_untrusted(honest tagging):Same verdict, same exit 1. In the default
shared_contextmode a mid-session capability flip cannot produce a false pass, because the gate never reasons about values at all — it puts every non-isolated tool on one context bus and assumes maximal composition. Under-tagging a dual-role tool costs you path count, not the verdict.Which reframes what taint-tracking would buy there: precision, not safety. It would tell you which of those two paths is actually live this session, instead of blocking on both. Useful for triage, not for the block decision.
The place where taint-tracking would buy real safety is the other mode —
data_flow: "explicit", where only declared edges carry taint and one unenumerated composition edge is a silent clean pass. That's the actual hole, and it lives in the declaration rather than the runtime.