DECISION
Gate
Keep the dependency out of the production agent path until the identified high-risk boundaries have an approved mitigation.
Illustrative deliverable
An evidence pack that gives owners a production answer.
This is a sanitized, illustrative example—not a customer case study, benchmark, or certification. It shows the shape of the private deliverable produced for a Release Gate Pilot.
Executive verdict
Gate pending review.
The illustrative server exposes useful automation capabilities, but broad command- and write-capable boundaries need owner action before production agent dependency. The right answer is not “blocked forever”; it is a specific gate, remediation order, and review date.
OWNER
Platform / security
Assign a named owner to the release decision and each remediation action.
NEXT REVIEW
After CI evidence
Re-run the same evidence after the mitigation and drift baseline are in place.
Evidence table
Every finding carries an action.
HIGH · PERMISSION BOUNDARY
Broad command input
Evidence: write-capable tool accepts broad command-like input.
Action: constrain inputs with typed arguments or allowlists and require explicit approval.
MEDIUM · DRIFT
Schema broadening
Evidence: a tool contract now accepts a broader request surface.
Action: add lock-file verification and gate unreviewed widening in CI.
MEDIUM · DESCRIPTION INTEGRITY
Agent-directed metadata
Evidence: tool descriptions mix instructions with user-facing semantics.
Action: keep metadata factual and move operational instructions out of the tool contract.
CI handoff
The decision keeps running after the pilot.
CI POLICYBlock new high-risk driftStart with review visibility, tune the policy, then block only the agreed high-severity changes.
Handoff includes
A reproducible command/configuration, JSON and Markdown evidence, SARIF for GitHub Code Scanning, a drift baseline, and documented exceptions.
Excluded: production credentials, destructive tool calls, customer data exfiltration, external attacker infrastructure, certification, and compliance attestation.
Owner-ready remediation
Six actions, one accountable decision.
1. Separate authority
Split read-only and write-capable tools into distinct permission groups.
2. Constrain inputs
Replace free-form command/path input with typed values, allowlists, or sandboxed fixtures.
3. Gate drift
Baseline schemas and block unreviewed authority expansion in CI.