Follow-up from #28. The fix there stops agent-supplied args from overwriting the trusted tool/type fields, but the action dict is still flat, so untrusted args continue to drive rule evaluation directly. GOV-003 reads action["amount"] straight from agent-supplied tool input, and any future rule reading a flat key inherits the same problem.
The decision-record and enforcement paths already use the safe shape: {"type": ..., "tool_name": ..., "arguments": {...}}. The tool_calls buffer entry should match, with GOV-003 (and any rule reading arg-derived keys) updated to read from arguments. This is a breaking change for anyone with custom policy rules reading flat keys, so it needs a deprecation note and a migration line in the changelog.
Acceptance:
- No untrusted key can appear at the top level of
context["action"]
- GOV-001/002/003 tests pass against the nested shape
- Custom-rule migration documented
Follow-up from #28. The fix there stops agent-supplied args from overwriting the trusted
tool/typefields, but the action dict is still flat, so untrusted args continue to drive rule evaluation directly. GOV-003 readsaction["amount"]straight from agent-supplied tool input, and any future rule reading a flat key inherits the same problem.The decision-record and enforcement paths already use the safe shape:
{"type": ..., "tool_name": ..., "arguments": {...}}. The tool_calls buffer entry should match, with GOV-003 (and any rule reading arg-derived keys) updated to read fromarguments. This is a breaking change for anyone with custom policy rules reading flat keys, so it needs a deprecation note and a migration line in the changelog.Acceptance:
context["action"]