These synthetic, tested examples show how 5D's action-policy gate can permit, block, or hold a proposed AI-agent action for review. This page does not call a model, reviewer, tool, or external service.
Illustrative simulation · no live action executed.
ExportCustomerData → external_crm Matched tested policy condition: regulated data cannot leave the approved destination set.
Intent becomes a typed proposed-action envelope before policy evaluates the request.
Advisory AI evidence can inform policy. It cannot permit an action.
{
"schema": "ActionObservation",
"external_transfer": 0.97,
"purpose_consistent": 0.42,
"uncertainty": 0.08
} The host supplies the tool, target, purpose, and principal.
Optional context or reviewer evidence remains advisory.
Policy permits, blocks, or selects human review.
The host executes only a permitted action and records the observed result separately.
Data boundary: only the displayed tool, target, purpose, and scenario-specific evidence fields cross to the simulated observer. Principal validation, policy ownership, grant source, and deterministic evaluation remain local. Nothing is persisted or transmitted by this page.
Invalid input or a deterministic-policy error stops before execution. Missing or malformed optional evidence cannot permit an action. An unavailable or expired reviewer leaves the review branch unresolved. Each retry receives a new attempt ID and is evaluated against the current input and policy. Duplicate delivery or an unknown downstream outcome requires reconciliation by the integration owner.
demo-action-blocked-001demo-attempt-blocked-001-a1REDBLOCKrecorded · cannot permitnot applicablenot applicableblocked before simulated executionrecorded in example receiptnot attemptedDownload the illustrative schema. This is not a production receipt and does not claim that one entry point implements the complete integration contract.
These are worked examples, not production results.
Matched tested policy condition: regulated data cannot leave the approved destination set.
blocked before simulated executionPolicy selected explicit human review. The simulated reviewer recorded acceptance; policy then resolved the declared review branch to PERMIT.
simulated permit · no external actionThe tool, target, purpose, and authority matched an explicit policy rule.
simulated permit · no external actionEach example uses the tested 5D 0.7.0 algorithm and a declared four-band policy profile. The normalized score uses the tested 0–3 output scale and describes the illustrated action, not a historical incident or the safety of a whole deployment.
The agent mistakes the live target for a disposable test environment. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA deterministic RED decision before the call.
Host ownsRouting every database executor through the gate and refusing the call.
Coverage limitA direct or alternate database path bypasses this gate.
Untrusted context steers the plan toward deleting live resources and snapshots. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA deterministic RED decision and rationale.
Host ownsPlan validation, complete interception, and execution refusal.
Coverage limit5D does not inspect every Terraform semantic or prove recovery.
A low-impact edit may still be wrong, but stays reviewable and reversible. Under the pinned illustrative policy, the expected result is eligible to proceed.
5D suppliesA GREEN action-risk band under the declared envelope.
Host ownsWorkspace isolation, code review, and the final merge.
Coverage limitGREEN is eligibility under this profile, not proof that the edit is correct.
Prompt injection pivots from untrusted issue text into a privileged release path. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA deterministic block at the privileged publish boundary.
Host ownsWorkflow permissions, token isolation, and coverage of every release path.
Coverage limit5D does not secure CI caches or registry credentials by itself.
Policy 0.7.0-catalogue-four-band · YELLOW enabled · source 5a5e991 · bands and host dispositions are separate.
A broad query and external destination exceed the declared data boundary. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA RED decision before external transfer.
Host ownsData classification, destination truth, and enforcement across every egress path.
Coverage limitUnclassified data or an uncovered uploader can bypass the intended boundary.
The input may be inaccurate, but the action has limited privilege and exposure. Under the pinned illustrative policy, the expected result is eligible to proceed.
5D suppliesA GREEN action-risk band for the declared request.
Host ownsAllowlisted endpoints, content validation, and later use of the data.
Coverage limitGREEN does not certify the source or the report's accuracy.
The agent follows a request that treats secrets as ordinary diagnostic data. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA deterministic RED decision at the attachment boundary.
Host ownsSecret detection, destination control, and credential rotation after exposure.
Coverage limit5D only sees the action context supplied by the host.
Material shared for narrow access becomes discoverable at broad scale. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA RED decision before material enters the public index.
Host ownsClassification, access control, deletion, and complete indexing-path coverage.
Coverage limitThe gate does not discover every sensitive field without truthful context.
Policy 0.7.0-catalogue-four-band · YELLOW enabled · source 5a5e991 · bands and host dispositions are separate.
A manipulated invoice changes the destination before payment. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA deterministic RED decision before payment creation.
Host ownsBeneficiary verification, payment authorization, and executor coverage.
Coverage limit5D is not a payment rail and cannot reverse a transfer.
The draft may be wrong but cannot create a commitment on its own. Under the pinned illustrative policy, the expected result is eligible to proceed.
5D suppliesA GREEN band for creation of the internal draft.
Host ownsContent review and preventing the draft from becoming an offer.
Coverage limitThe later send or acceptance action needs its own gate.
A fabricated complaint or mistaken account match triggers value movement. Under the pinned illustrative policy, the expected result is to hold the action until the host records the required review.
5D suppliesAn ORANGE band and hold signal.
Host ownsReviewer identity, authority, approval freshness, and final execution.
Coverage limit5D does not supply the approval queue or authenticate the reviewer.
Prompt manipulation makes the model claim authority it does not have. Under the pinned illustrative policy, the expected result is to hold the action until the host records the required review.
5D suppliesAn ORANGE band before an order commitment.
Host ownsDefining actual commercial authority and binding the approved amount.
Coverage limitA text response outside the gated order tool remains outside enforcement.
Policy 0.7.0-catalogue-four-band · YELLOW enabled · source 5a5e991 · bands and host dispositions are separate.
A spoofed request or misbound identity escalates privileges. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA deterministic RED decision before privilege escalation.
Host ownsAuthentication, requester authority, grantee validation, and enforcement.
Coverage limitCaptured identity assertions are not authenticated by 5D.
Social engineering supplies plausible but unverified recovery facts. Under the pinned illustrative policy, the expected result is to hold the action until the host records the required review.
5D suppliesAn ORANGE hold signal for the credential change.
Host ownsRecovery proof, reviewer authentication, and the reset channel.
Coverage limit5D does not verify identity evidence or operate the recovery workflow.
The read may be overbroad but does not mutate authority. Under the pinned illustrative policy, the expected result is eligible to proceed.
5D suppliesA GREEN band for the declared read.
Host ownsDirectory scoping, rate limits, and protection of the inventory output.
Coverage limitThe band assumes the supplied data classification is correct.
An attacker uses the support channel to remove account protections. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA deterministic RED block for the declared change.
Host ownsIdentity proofing, break-glass policy, and complete account-path coverage.
Coverage limitAn administration console that bypasses the gate remains outside enforcement.
Policy 0.7.0-catalogue-four-band · YELLOW enabled · source 5a5e991 · bands and host dispositions are separate.
The source may be wrong, but the action remains read-only and bounded. Under the pinned illustrative policy, the expected result is eligible to proceed.
5D suppliesA GREEN band for the bounded read action.
Host ownsSource allowlisting, truth checking, and preventing retrieved text from granting authority.
Coverage limit5D does not establish that the source or summary is correct.
Prompt injection on a page redirects the agent across trust boundaries. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA RED decision before cross-boundary data entry.
Host ownsBrowser interception, authenticated-session isolation, and destination truth.
Coverage limitTyping or navigation not routed through the gate remains outside enforcement.
A malicious source turns research into privileged local code execution. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA deterministic RED block at the shell boundary.
Host ownsSandboxing, provenance checks, and interception of every executor.
Coverage limit5D does not analyze arbitrary program behavior.
Untrusted claims could influence later work if the draft loses its provenance. Under the pinned illustrative policy, the expected result is to hold the action until the host records the required review.
5D suppliesAn ORANGE hold signal for the provenance-sensitive write.
Host ownsSource labeling, review, and separation between draft and trusted knowledge.
Coverage limitThe score does not validate the retrieved claim.
Policy 0.7.0-catalogue-four-band · YELLOW enabled · source 5a5e991 · bands and host dispositions are separate.
The wording may be wrong, but the draft cannot send itself. Under the pinned illustrative policy, the expected result is eligible to proceed.
5D suppliesA YELLOW action-risk band for draft creation.
Host ownsThe review queue, content quality, and a separate gate for sending.
Coverage limitYELLOW is enabled in this illustrative profile; 0.7.0 folds it to GREEN by default.
The model invents facts and immediately attributes them to the organisation. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA RED decision before publication.
Host ownsAccount controls, editorial approval, and every publication connector.
Coverage limitThe policy gate cannot recall copied public content.
Generated guidance contradicts the applicable policy and appears authoritative. Under the pinned illustrative policy, the expected result is to hold the action until the host records the required review.
5D suppliesAn ORANGE hold signal before sending the commitment.
Host ownsPolicy retrieval, content review, reviewer authority, and final send.
Coverage limit5D does not determine the correct refund policy.
Untrusted instructions introduce harmful code or disclose internal material. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA deterministic RED decision before the push.
Host ownsBranch protection, token scope, review, signing, and connector coverage.
Coverage limit5D does not inspect every code defect or secure the repository host.
Policy 0.7.0-catalogue-four-band · YELLOW enabled · source 5a5e991 · bands and host dispositions are separate.
The subagent may return poor evidence but cannot mutate an external system. Under the pinned illustrative policy, the expected result is eligible to proceed.
5D suppliesA GREEN band for the bounded delegation envelope.
Host ownsTool allowlists, worker isolation, and validation of returned evidence.
Coverage limitActions taken by the worker need their own interception boundary.
The parent hides privilege escalation inside a seemingly routine delegated task. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA RED decision on the delegated capability request.
Host ownsPropagating policy to the worker and gating every nested tool call.
Coverage limitScoring only the parent delegation does not govern hidden downstream calls.
Delegation launders authority across agents and bypasses the original approval boundary. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA deterministic RED decision before authority crosses agents.
Host ownsIdentity validation, delegation scope, and interception at the executing peer.
Coverage limit5D cannot enforce a boundary inside an agent that never calls the gate.
No component retains a complete view of authority, retries, destinations, or accumulated side effects. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
5D suppliesA RED decision on the declared delegation envelope.
Host ownsPer-agent credentials, bounded tasks, attempt tracking, cancellation, and nested interception.
Coverage limitOne top-level score cannot govern an opaque multi-agent graph.
Policy 0.7.0-catalogue-four-band · YELLOW enabled · source 5a5e991 · bands and host dispositions are separate.
Explore how a declared deterministic share changes the volume routed to an optional observer while policy remains the permission authority.
Tool, target, purpose, principal, and context enter one declared contract.
Versioned rules resolve declared inputs on documented integration paths.
Observer evidence can tighten or hold. It cannot clear an explicit block.
Declared assumptions, not measured 5D performance.
365-day illustrative year. Currency is a display/input unit; no exchange-rate conversion is applied.
Policy intent, implementation, threat review, human disposition, and reconstructable evidence stay connected without transferring organisational accountability to a model.
Start from public primitives: inspectable policy evaluation, verdicts, documented adapters and gateways, and evidence records. The support matrix states what version 0.7.0 verifies and what the host still owns.
Routing share depends on your policy and traffic.
Observer cost is user-supplied; it is not a 5D price or forecast.
Estimated variable observer spend excludes deterministic infrastructure, human review, retries, and other deployment costs.
Model cost and latency vary with provider, model, caching, concurrency, and deployment design.
Hash-locked Python 3.11 wheels install offline before five non-destructive checks reverify and exercise the exact public 0.7.0 wheel.
A demonstration read returns the executable sentinel without touching a real file or tool.
An ORANGE result remains held, while a destructive command returns RED and BLOCK.
An in-memory counter advances without the gate and stays unchanged behind the blocking gate.
The pack does not prove complete path coverage, authenticated authority, a reviewer service, authoritative custody, full framework support, or deployment suitability. Retry, unknown-outcome, reconciliation, and challenge records are clearly marked as examples.
Describe the proposed action path, its highest-risk side effect, and the authority boundary you need to preserve. We can start with the smallest testable integration boundary.
Selecting Draft email opens a prefilled draft in your configured email app or provider. The site does not send or store it. Review the draft before sending. Do not include secrets, credentials, regulated data, or customer data.
Prefer to start directly? Email hello@langoni.me.
These are reference shapes for exploration, not claimed integrations.
Normalize the tool, target, purpose, and identity context before a case system is touched.
Pair with the authority guideKeep uncertain context and a human decision separate from the policy disposition.
Pair with the retry guideMake the destination boundary explicit and preserve a reconstructable receipt.
Pair with the evidence guideThe host application still owns identity validation, tool execution, retries, and downstream reconciliation.
Normalize the intended action and its context.
Apply deterministic policy; optional model evidence cannot grant permission.
Only the host integration performs or withholds the external action.
Read the complete action flow for the decision contract and illustrated path.