From 2869dfc08454b98842e7e83a8e9d668558dbac60 Mon Sep 17 00:00:00 2001
From: sxyrxyy <125439203+sxyrxyy@users.noreply.github.com>
Date: Wed, 22 Jul 2026 23:23:06 -0400
Subject: [PATCH] fix(governance): stop agent args from overriding the tool
 name in the policy gate

The action dict inspected by GovernanceLayer was built as
`{"tool": tool_name, "type": "tool_call", **tool_input}`. Spreading the
agent-supplied arguments last let an argument named `tool` overwrite the
real tool name. GOV-001 checks `action["tool"]` against the sensitive-tool
set, so a HIGH/CRITICAL agent calling e.g. `payment_execute` with an
argument `{"tool": "noop"}` read as a non-sensitive tool and skipped the
REQUIRE_APPROVAL escalation.

Spread the arguments first so the trusted `tool`/`type` fields always win.
Keeps the flat action shape (GOV-003 still reads `action["amount"]`).
---
 src/agentegrity/adapters/base.py | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/agentegrity/adapters/base.py b/src/agentegrity/adapters/base.py
index 42fce5d..603dcb3 100644
--- a/src/agentegrity/adapters/base.py
+++ b/src/agentegrity/adapters/base.py
@@ -712,7 +712,12 @@ def _handle_pre_tool_use(self, data: dict[str, Any]) -> dict[str, Any]:
 
         self._append_capped(
             self._buffer.tool_calls,
-            {"tool": tool_name, "type": "tool_call", **tool_input},
+            # Spread the agent-supplied arguments FIRST so the trusted
+            # "tool"/"type" fields always win. This dict becomes
+            # context["action"], which GovernanceLayer's GOV-001 checks
+            # against the sensitive-tool set; letting an argument named
+            # "tool" override the real name would bypass that gate.
+            {**tool_input, "tool": tool_name, "type": "tool_call"},
             "tool_calls",
         )
         self._buffer.tool_usage[tool_name] += 1