Rules and SQL
| Case | Attack | Expected | Happened |
|---|
| H01 | Prompt-injected DROP TABLE after reading a poisoned row | Blocked | Blocked |
| H02 | DELETE without WHERE | Blocked | Blocked |
| H03 | Multi-statement smuggling, including a stacked COMMIT; | Blocked | Blocked |
| H04 | Comment-obfuscated DDL (block, nested and inline comments) | Blocked | Blocked |
| H05 | COPY … TO PROGRAM | Blocked | Blocked |
| H06 | DO $$ … $$ block | Blocked | Blocked |
| H07 | CTE write hidden in a SELECT | Blocked | Blocked |
Check against the database
| Case | Attack | Expected | Happened |
|---|
| H08 | Trigger fan-out: the agent reports 1 row, Postgres commits 301 | Doesn't match | Doesn't match |
| H09 | Trigger changes a column outside the SET list | Doesn't match | Doesn't match |
| H10 | Forged deedglass marker from another session, no ledger row (V7 analogue of D01) | Caught | Caught |
| H11 | Write to a watched table without REPLICA IDENTITY FULL | Can't check | Can't check |
Identity, intents and budgets
| Case | Attack | Expected | Happened |
|---|
| J01 | Call with a suspended agent's key | Refused | Refused |
| J02 | Call with a revoked key | Refused | Refused |
| J03 | Signed-intent replay, sequential and 16 at once | Refused | Refused |
| J04 | Budget burst: 200 calls in 1 s against 60/min | Blocked | Blocked |
Connectors, egress and secrets
| Case | Attack | Expected | Happened |
|---|
| K01 | SSRF to 169.254.169.254 via the REST connector | Blocked | Blocked |
| K02 | SSRF via redirect (to metadata, and cross-host) | Blocked | Blocked |
| K03 | Credential exfiltration through an upstream error message | Hidden | Hidden |
| K04 | Tool-name confusion by an upstream MCP server | Blocked | Blocked |
Check against the database: expected and seen
| Case | Attack | Expected | Happened |
|---|
| W01 | The hero: an AFTER trigger ships 300 other orders when one order ships | Doesn't match | Doesn't match |
| W02 | A BEFORE trigger also sets total_cents = 0 on the row the statement names | Doesn't match | Doesn't match |
| W03 | A BEFORE trigger rewrites NEW.status to 'cancelled' | Doesn't match | Doesn't match |
| W04 | An AFTER trigger deletes another row of public.orders | Doesn't match | Doesn't match |
| W05 | Another session emits a transactional deedglass marker naming a live action | Caught | Caught |
| W06 | A superuser writes a second ledger row and marker for an action | Doesn't match | Doesn't match |
| W07 | REPLICA IDENTITY DEFAULT on the target table, a clean update, check: Proven | Can't check | Can't check |
| W08 | The W01 trigger on a REPLICA IDENTITY DEFAULT table | Doesn't match | Doesn't match |
| W09 | UPDATE … FROM another table, check: Proven | Can't check | Can't check |
| W10 | The decoder is held back, the action seals at the Proven timeout, then the decoder catches up | Matches | Matches |
| W11 | The replication slot is dropped while an action waits for Proven | Can't check | Can't check |
| W12 | deedglass_pub dropped and re-created around an action (PG 18) | Can't check | Can't check |
| W13 | A ledger row whose sql_digest differs from the authorized SQL (a simulated compromised path) | Doesn't match | Doesn't match |
Approvals, links and webhooks
| Case | Attack | Expected | Happened |
|---|
| L01 | Approval link replay: the emailed link used again after it approved | Refused | Refused |
| L02 | Another approver's token: a link presented after its owner already countersigned a four-eyes approval | Refused | Refused |
| L03 | Self-approval through Deedglass-On-Behalf-Of naming the approver | Refused | Refused |
| L04 | An agent key approving its own action | Refused | Refused |
| L05 | A decision after the approval expired | Refused | Refused |
| L06 | A decision on a stale context digest | Refused | Refused |
| L07 | A webhook URL to the cloud metadata service | Blocked | Blocked |
| L08 | A forged webhook signature checked with webhook.Verify | Refused | Refused |
Undo
| Case | Attack | Expected | Happened |
|---|
| U01 | An undo whose rows change between the preview and the run | Refused | Refused |
| U02 | An undo request that smuggles values or a tampered plan digest | Refused | Refused |
| U03 | An undo of an action after a forged marker names it in another transaction | Refused | Refused |
| U04 | An agent calling the internal undo tool through POST /v1/actions | Blocked | Blocked |
| U05 | An undo of another org's action | Refused | Refused |
Observe mode
| Case | Attack | Expected | Happened |
|---|
| O01 | Another org closes, excludes from, previews and undoes a watched session | Refused | Refused |
| O02 | An agent hides from its own recording: opens, closes, excludes and undoes a session with its key; a person's exclude is recorded | Blocked | Blocked |
People, sessions and the live stream
| Case | Attack | Expected | Happened |
|---|
| P02 | Approval X's emailed link used with approval Y's context digest, and a link voided when its approval was cancelled | Refused | Refused |
| P03 | Forged Slack interaction: a bad signature, a valid signature 6 min old, and a replay of a valid payload | Refused | Refused |
| P04 | Self-approval in Slack: the person the action runs for clicks Approve | Refused | Refused |
| P05 | Two concurrent approves by the same person on a four-eyes approval, 10 times | Refused | Refused |
| P06 | A viewer calls approve, activate policy, stop-all and create key | Refused | Refused |
| P07 | Cross-site POST to a Console mutation without the CSRF header, and with a CSRF token from another session | Refused | Refused |
| P08 | SSE /v1/events from org B with a Last-Event-ID taken from org A's stream | Refused | Refused |
| P10 | Stop-all mid-burst (S18's J05): 200 calls in flight | Refused | Refused |
Hostile MCP servers and upstreams
| Case | Attack | Expected | Happened |
|---|
| Q01 | Upstream MCP tools/list with instruction-bearing descriptions ("ignore previous instructions", hidden Unicode tag characters, an <IMPORTANT> block) | Caught | Caught |
| Q02 | Tool definition changes after the first listing (rug pull: same name, new schema or description) | Blocked | Blocked |
| Q03 | Tool-name shadowing: two upstreams expose read_file on the same Rules | Refused | Refused |
| Q04 | Upstream returns a 50 MiB result, and a result nested 10,000 deep | Blocked | Blocked |
| Q05 | Upstream down or hanging (fail-closed default) | Blocked | Blocked |
| Q06 | Upstream MCP server sends sampling/createMessage and elicitation/create through mcp wrap | Blocked | Blocked |
| Q07 | Stripe live key smuggled via PUT /v1/connectors/{id}/credentials and PATCH /v1/connectors/{id} | Refused | Refused |
| Q08 | Webhook to a host that resolves to cloud metadata at delivery (rebinding), and a webhook that redirects to loopback | Blocked | Blocked |
Resources, records and output
| Case | Attack | Expected | Happened |
|---|
| R01 | Policy YAML bomb (alias expansion, 60,000 nodes, 10^6 nodes, a 20 MiB file) | Refused | Refused |
| R02 | CEL cost bomb (nested comprehensions at lint; a 20,000-item list at run time) | Refused | Refused |
| R03 | Record chain fork: a second record after the same parent, and an exported chain with a spliced branch | Caught | Caught |
| R04 | Clock-skewed signed intent (iat 10 min in the future and 10 min in the past) | Refused | Refused |
| R05 | Prompt injection through the suggestion channel: tool names and rule ids crafted to steer the LLM phrasing | Caught | Caught |
| R06 | Oversized and deeply nested JSON on POST /v1/actions (1 MiB + 1, args 129 deep, a body 10,000 deep) | Refused | Refused |
| R07 | Log injection: tool names and args carrying ANSI escapes and newlines reach CLI output, logs and the Console | Hidden | Hidden |
Record chains after the run: intact. Report a problem