Reference lab · action

Governed Action Lab

An agent can propose a retry, but cannot approve it itself. I built policy gates, human approval, and verifiable receipts.

Scenario clock: 09:10 UTC, 28 Jul 2026, fixed.

From lab 1: Docs Build failed at 08:40.

Try the three public paths.

The agent proposes three next steps. Policy has checked each one.

Loading the policy engine.

Read Docs Build's failed run record Checking policy

Retry Docs Build in the sandbox Checking policy

Changes state, so policy holds it for a person. You are that person.

Delete Weekly Report's unpublished output Checking policy

What happens to this proposal

ProposedBy the agent, at 09:10 on the scenario clock.
PolicyChecking policy.
ApprovalNot yet.
RunsNot yet.
RecordNot yet.

The exact request the agent sent

The request appears once the policy engine has loaded.

Synthetic sandbox in your browser. Not production authorization. Nothing is uploaded.

This lab runs its policy in your browser with JavaScript. Without it, read the walkthrough on GitHub.

Three rules, written down.

The policy is a small file, not a model. These rows are read from the file this page uses.

The rules appear once the policy engine has loaded.

Eleven attacks, all held.

Each runs against the real policy, approval, executor, and receipt code in CI on every change. They do not run in this page.

Attack	Result	Weakness class
Swap the retry payload after approval`ARGUMENT_SUBSTITUTION`	Denied	OWASP LLM06:2025, CWE-345
Use the same approval twice`APPROVAL_REPLAY`	Denied	OWASP LLM06:2025, CWE-294
Run another agent's request with an approval`CONFUSED_DEPUTY`	Denied	OWASP LLM06:2025, MITRE ATLAS AML.T0053, CWE-441
Change the target between check and run`TOCTOU_CHANGED_STATE`	Denied	CWE-367
Edit a receipt after the fact`RECEIPT_CONTENT_TAMPERING`	Detected	CWE-345
Use an approval after it expires`EXPIRED_APPROVAL_REUSE`	Denied	CWE-613
Name the job with a look-alike character`CANONICALIZATION_BYPASS`	Denied	OWASP LLM01:2025, CWE-289, CWE-706
Point an approval at different evidence`APPROVAL_SCOPE_WIDENING`	Denied	OWASP LLM06:2025, CWE-345
Edit the policy after it was trusted`POLICY_MANIFEST_TAMPERING`	Denied	OWASP LLM03:2025, CWE-345
Reuse the public policy's name with new rules`PUBLIC_POLICY_IMPERSONATION`	Denied	OWASP LLM03:2025, CWE-290, CWE-345
Reuse a request key for a different action`IDEMPOTENCY_KEY_COLLISION`	Denied	CWE-694

A weakness class names what the attack would exploit without this layer. It is not a certification. Reproduce with npm run demo:attacks. Read the attack matrix

What this proves, and what it does not.

It proves deterministic policy can allow, hold, or refuse typed synthetic actions, bind one human approval to one exact request, and leave records whose digests you can recompute.

It does not provide production authorization, tamper-proof audit logs, or machine isolation, and it cannot make bad evidence true. Everything here is synthetic and runs in a browser sandbox.

Claim	How to check it
36 of 36 evaluations pass: 26 adversarial, 3 fault injection, 7 intended path.	Run `npm run eval` in the repository. CI runs it on every change.
11 of 11 named attacks held.	The table above, or `npm run demo:attacks`.
The agent cannot approve itself.	Its MCP server exposes 5 tools, and none of them creates an approval. The approval store must stay outside the agent's reach; see SECURITY.md.
An approval works once and expires.	Enforced and tested in CI (`APPROVAL_REPLAY`, `EXPIRED_APPROVAL_REUSE`). This page only simulates it.
Receipts are verifiable.	Change one field on a receipt above. Or save it and run `npm run action -- verify-receipt --receipt <file>`.
Nothing leaves your browser.	Open the network panel while you use this page. After it loads, nothing is requested.

The proof file.

One complete read-only run, frozen so anyone can check it. It shows the run is internally consistent. It does not prove who produced it or show any external action.

Download the proof file (JSON)

npm run action -- verify-proof --proof docs/governed-action-proof.json

Check a file.

Open a Context Layer diagnostic, this lab's proof file, or a receipt you saved. It is read in this tab only. A diagnostic or proof file recomputes all three paths; decisions inside the file are never trusted.

No file? Get lab 1's diagnostic (JSON).

Showing the public sample.

Run it yourself.

git clone https://github.com/Kaagemusha/governed-action-lab
cd governed-action-lab
npm ci
npm run eval
npm run demo:attacks

Version 1.2.4, released 3 Oct 2026.

Before this: what is true now.

Lab 1 of 2 decides whether the scheduled jobs are healthy before anyone acts. This lab starts from its answer.

Open Context Layer Lab