Integrations and the enforcement modes
How an agent host, a workflow engine or a feed connects to ExecBound, and, on every row, what that path enforces and how we know. The three tables are rendered from integrations/manifest.json by scripts/render_integrations.py, and tests/test_integrations_manifest.py refuses a manifest whose claims the repository does not back, so this page keeps the rule of the planning pack, "state the actual tested version and whether the path is enforced or advisory", by machine rather than by memory. Design on #250.
Three placements
- Execute: an agent asks ExecBound to act. The HTTP client, MCP hosts, the SDK tool examples and the Tines governed-action story.
- Gate: a workflow keeps its own connector and asks for a plan-bound decision before it acts. The external execution checkpoint and the Arcade Logic Extension.
- Monitor: feeds. Tines instrumented stories and collection, Entra Agent ID from Scout, the Falcon feed from Edge, the coding-agent proxy.
Enforcement modes
Copied from the architecture and enforcement plan. The mode is kept per action path, never per vendor.
| Mode | Required evidence | Permitted claim |
|---|---|---|
| Native | Agent has only its gateway identity; credentials inaccessible; all protected operations traverse executor; bypass tests fail | Enforced for the documented protected paths |
| Integrated | Existing control point blocks execution, binds the exact request, fails closed, protects credentials, participates in state and receipts | Enforced only for the integration profile and routes tested |
| Embedded | Hook/SDK cannot be removed or bypassed by the protected agent; secrets and configuration are isolated | Enforced only within the proven runtime boundary |
| Advisory | Decision can be skipped, hook bypassed, or upstream credential used directly | Recommendation or would-have decision |
| Observed | Telemetry only | Visibility without action prevention |
| Unknown | Insufficient or stale evidence about the path | Coverage unknown |
Evidence states
- research-only: a recipe or a design exists; nothing has been run and recorded. The row shows mode Unknown, because the mode table defines Unknown as insufficient evidence; the designed mode appears only once the row is fixture-tested or better.
- fixture-tested: CI runs the path against synthetic fixtures at a pinned version; the row names the test node ids and the versions it pins.
- platform-validated: a named, dated trial against the real host or product, recorded under
docs/trials/with the fields of the validation interview guide (host and version, operating system, transport, MCP client, SDK and protocol versions, gateway commit, fixture seed, the scenarios and the exact results, failures and limits as observed).
A row moves up by evidence and only by evidence: a test that runs in CI promotes research-only to fixture-tested, and a trial record promotes it to platform-validated. A newer host version is not claimed until it is re-trialled; the row keeps the version it was recorded at. What an adapter must bring to be admitted at all is in the admission criteria of the landscape document, whose entries are candidates, not compatibility claims. Commercially backed connectors are a separate offering (#122); this page records evidence and makes no commercial promise.
Execute
| Entry | Mode | Evidence | Tested versions | Recipe | Limits |
|---|---|---|---|---|---|
| Claude Agent SDK tool example (landscape) | Unknown | research-only | none claimed | recipe | Research-only until the example runs in CI against a stub model runner |
| Claude Code (landscape) | Unknown | research-only | none claimed | recipe | Promoted by its trial record under docs/trials/ (the named host trial, #26) |
| Claude Desktop and claude.ai connectors | Unknown | research-only | none claimed | none yet | Waits for the MCP authorization server; these hosts accept OAuth only, not a static bearer credential |
| Cursor (landscape) | Unknown | research-only | none claimed | recipe | Promoted by its trial record under docs/trials/, after the Claude Code trial |
| execbound-client over HTTP (Python) (landscape) | Native | fixture-tested: tests/test_client_package.py::test_waits_for_approval_then_progresses_the_same_intent, tests/test_demo_driver.py::test_the_driver_runs_all_six_beats_from_the_private_directory | execbound 0.1.0, sdk 0.1.0, protocol HTTP v1 | recipe | The boundary beat is the bypass test: the agent holds the gateway credential and nothing else; a host that can reach the upstream credential is outside this row |
| MCP with the maintained 1.30 client (landscape) | Native | fixture-tested: tests/test_mcp_surface.py::test_actual_maintained_mcp_client | execbound 0.1.0, sdk 1.30.0, protocol 2025-11-25 | recipe | Hash-locked legacy client environment (tests/mcp-legacy.txt); static bearer only |
| MCP with the official Python SDK (landscape) | Native | fixture-tested: tests/test_mcp_surface.py::test_current_mcp_pending_identity_switch_and_http_retry, tests/test_examples.py::test_mcp_example_completes_the_same_flow_through_the_sdk | execbound 0.1.0, sdk 2.2.0, protocol 2026-07-28 | recipe | Static bearer credential per host; there is no MCP authorization server yet |
| OpenAI Agents SDK tool example (landscape) | Unknown | research-only | none claimed | recipe | Research-only until the example runs in CI against a stub model runner |
| Tines governed-action story (landscape) | Advisory | fixture-tested: tests/test_tines_story.py::test_the_rendered_wire_body_is_one_the_gateway_accepts | execbound 0.1.0, host Tines schema 30, lib 95 | recipe | The committed export was imported into a Tines tenant and fired against the hosted gateway at 7e4ac15: the chain reached the gateway, the body parsed as an ActionRequest and the answer was reported; Only the refusal branch has run, because the probe used a placeholder credential; allow, deny, approval from a phone, the 429 retry and the polling loop are unverified, so the row is not marked platform-validated; Advisory rather than Native: the story calls ExecBound voluntarily and nothing forces the call, so a story that skips it is not governed by anything |
Gate
| Entry | Mode | Evidence | Tested versions | Recipe | Limits |
|---|---|---|---|---|---|
| Arcade Logic Extension (landscape) | Advisory | platform-validated: trial record | execbound 0.1.0, host arcade-cloud-2026-09-18, sdk Github 5.0.0 | none yet | Advisory, not the Integrated the design targets: failing closed is a customer setting the extension cannot read, and a post hook is a runtime report not a receipt, so no settlement rises above tier ASSERTED; One live playground call on 18 September ran the whole chain, so the grant, the report window, the asserted settlement and an administrator's attested correction are measured rather than claimed; A settlement from a vendor success ran only against the hook process on loopback: a claimed incident must occupy one of the tool's declared inputs and SetStarred has no spare one; Mode is kept per action path, so an ungoverned toolkit stays Unknown |
| External execution checkpoint (landscape) | Integrated | fixture-tested: tests/test_checkpoint.py::test_gc1_a_deployed_checkpoint_answers_with_a_grant_and_dispatches_nothing, tests/test_checkpoint.py::test_gc5_a_denied_checkpoint_grants_nothing_and_replays_to_the_same_decision | execbound 0.1.0, protocol checkpoint v1 | recipe | Enforced only for the tested profile: the executor's own control point must block execution, bind the exact request and report; an unreported grant is swept to uncertainty and never refunded |
Monitor
| Entry | Mode | Evidence | Tested versions | Recipe | Limits |
|---|---|---|---|---|---|
| Coding-agent MCP proxy (landscape) | Unknown | research-only | none claimed | none yet | Spike on #230: a local MCP proxy that turns a coding agent's tool calls into observations; not started |
| Entra Agent ID via Graph (Scout) (landscape) | Observed | fixture-tested: tests/test_scout_collection.py::test_a_run_acquires_one_token_and_then_only_reads, tests/test_scout_run.py::test_a_run_probes_records_and_retains_only_allowlisted_metadata | execbound 0.1.0 | recipe | The collector and Agents page are implemented; docs/SCOUT.md records a September 18 founder-lab probe, but no complete versioned trial record promotes this row; Inherited allAllowed permissions, real-agent activity attribution and populated customer directories were not exercised by the lab probe; Azure RBAC and role-bearing group paths remain gaps; Directory reach is evidence of possible authority, not execution prevention; a principal binding governs only its path through ExecBound |
| CrowdStrike Falcon feed (Edge) (landscape) | Unknown | research-only | none claimed | none yet | Brief written September 17, 2026 (#229); built after the raise with a design partner |
| Tines discovery and collection (landscape) | Observed | fixture-tested: tests/test_tines_collection.py::test_td1_probe_records_every_capability_and_retains_nothing_else | execbound 0.1.0, protocol monitor events v1 | recipe | Allowlisted story, action and credential metadata; a September 16 live inventory probe is recorded in docs/TINES_MONITORING.md, while audit and AI-audit collection lack the required account plan and remain fixture-tested |
| Tines instrumented stories (intake) (landscape) | Observed | fixture-tested: tests/test_monitoring_http.py::test_event_to_finding_and_admin_ack_preserves_execution_state | execbound 0.1.0, protocol monitor events v1 | recipe | A live Tines story delivered synthetic events on September 14, 2026; the row stays fixture-tested until a trial record in the interview format is written; Telemetry only: observations and findings never authorize, settle or consume limits |
Reading a row
Versions are what was tested, never "latest". Limits are one line and concrete. The evidence column names the CI tests or the trial record behind the row; a row with none is research-only and says so. No runtime is named negatively: a host without a row is a candidate whose trial has not been run.