Which boundary decides: approval, release, memory, tool, retrieval?
An agent reads a tool result, a memory, a retrieved passage or an updated tool description, then acts. Each of these five records names the boundary that should decide what happens next, and the evidence that would show it did.
Free local review records · v0.1 · October 22, 2026
Proposed cases, not test results.
Every acceptance case in these records is NOT RUN, except the retrieval cases partly executed against pinned code on October 23, 2026, whose results sit in that packet. The worked examples are fictional. The records help you write down what you approved, what may leave, what may instruct, what changed and what was granted; they do not enforce any of it.
Pick the decision your workflow is missing
Did the arguments the tool received match the proposal a person approved?
Four connected records bind the original proposal, the human edit, the stored replacement and the dispatched call. A worked example and a blank worksheet; proposed review aid, not implemented enforcement.
Which exact bytes may leave the private context, to which destination, by which operation?
An exact candidate artifact with its digest, destination and operation, a release envelope and twelve proposed acceptance cases. The small releasable note is published alongside as its fixture.
Can an unsupported permission enter storage, reach a later prompt and become an action?
Pairs a useful task with prohibited behavior across write, store, read and act. Records convention, storage, prompt reach and attempted external effect separately.
Which of definition, implementation and authority changed, and which did the client show you?
Works through a fictional support tool: unchanged description with a changed callback, wider credentials, a missed notification and a harmless maintenance update. Acceptance designs, not passing tests.
Who is the caller, is the permission still current, and is citation separate from action?
Fifteen proposed cases (R01–R15) covering caller identity, reuse, permission freshness and the separate citation and action paths. On October 23, 2026, ten were partly executed against pinned code run locally; the service-side cases still need a tenant you control.
Record enforcement, evidence and useful work separately
A blocked action is one observation. Whether the task still completed, and whether anyone could see what changed, are two more. Each record keeps those columns apart, and leaves a result unknown rather than inferring it from a quiet log.
These records extend the harness review and the agent access review. Articles explain the reasoning; the records are what you fill in.