A guard can enforce only what the host registered

The same document and egress guard produce opposite outcomes. The only variable is whether the tool result cycles through process_inbound before returning to the model.

You are here

SourceIngressEgressSink

Loop left open

1. The host appends the tool result directly

STATE RECORDED

The document goes straight into model context. process_inbound is never called, so no provenance span is registered.

registered spans = 0

2. Egress has nothing to match against

ALLOWED

The same guard runs on the same content.

clean

Loop closed

1. The host cycles the result through process_inbound

STATE RECORDED

The identical document is ingested first, which registers its origin.

registered spans = 1

2. Egress can now attribute the span

BLOCKED

The same guard runs on the same content.

Verbatim overlap (148 chars) with untrusted content from mcp_server:docstore

One variable: both columns use the same document and the same egress guard. The only difference is the ingress call the host did or did not make. Document under test: Partner launch notes: retain the internal pricing assumptions and migration schedule until the public announcement is approved by legal and finance.

Evidence, scope, and reproduction

Adversary A2Ingress + EgressT-IN8A-AS1 · A-AS9Source: SecurityPipeline.process_inboundTest: tests/test_demo_scenarios.py

Exact fixture test: tests/test_demo_scenarios.py::test_tool_feedback_fixture

.venv/bin/python -m pytest tests/test_demo_scenarios.py::test_tool_feedback_fixture -q

Generated fixture