Skip to main content

Integrations and the enforcement modes

How an agent host, a workflow engine or a feed connects to ExecBound, and, on every row, what that path enforces and how we know. The three tables are rendered from integrations/manifest.json by scripts/render_integrations.py, and tests/test_integrations_manifest.py refuses a manifest whose claims the repository does not back, so this page keeps the rule of the planning pack, "state the actual tested version and whether the path is enforced or advisory", by machine rather than by memory. Design on #250.

Three placements

  • Execute: an agent asks ExecBound to act. The HTTP client, MCP hosts, the SDK tool examples and the Tines governed-action story.
  • Gate: a workflow keeps its own connector and asks for a plan-bound decision before it acts. The external execution checkpoint and the Arcade Logic Extension.
  • Monitor: feeds. Tines instrumented stories and collection, Entra Agent ID from Scout, the Falcon feed from Edge, the coding-agent proxy.

Enforcement modes

Copied from the architecture and enforcement plan. The mode is kept per action path, never per vendor.

ModeRequired evidencePermitted claim
NativeAgent has only its gateway identity; credentials inaccessible; all protected operations traverse executor; bypass tests failEnforced for the documented protected paths
IntegratedExisting control point blocks execution, binds the exact request, fails closed, protects credentials, participates in state and receiptsEnforced only for the integration profile and routes tested
EmbeddedHook/SDK cannot be removed or bypassed by the protected agent; secrets and configuration are isolatedEnforced only within the proven runtime boundary
AdvisoryDecision can be skipped, hook bypassed, or upstream credential used directlyRecommendation or would-have decision
ObservedTelemetry onlyVisibility without action prevention
UnknownInsufficient or stale evidence about the pathCoverage unknown

Evidence states

  • research-only: a recipe or a design exists; nothing has been run and recorded. The row shows mode Unknown, because the mode table defines Unknown as insufficient evidence; the designed mode appears only once the row is fixture-tested or better.
  • fixture-tested: CI runs the path against synthetic fixtures at a pinned version; the row names the test node ids and the versions it pins.
  • platform-validated: a named, dated trial against the real host or product, recorded under docs/trials/ with the fields of the validation interview guide (host and version, operating system, transport, MCP client, SDK and protocol versions, gateway commit, fixture seed, the scenarios and the exact results, failures and limits as observed).

A row moves up by evidence and only by evidence: a test that runs in CI promotes research-only to fixture-tested, and a trial record promotes it to platform-validated. A newer host version is not claimed until it is re-trialled; the row keeps the version it was recorded at. What an adapter must bring to be admitted at all is in the admission criteria of the landscape document, whose entries are candidates, not compatibility claims. Commercially backed connectors are a separate offering (#122); this page records evidence and makes no commercial promise.

Execute

EntryModeEvidenceTested versionsRecipeLimits
Claude Agent SDK tool example (landscape)Unknownresearch-onlynone claimedrecipeResearch-only until the example runs in CI against a stub model runner
Claude Code (landscape)Unknownresearch-onlynone claimedrecipePromoted by its trial record under docs/trials/ (the named host trial, #26)
Claude Desktop and claude.ai connectorsUnknownresearch-onlynone claimednone yetWaits for the MCP authorization server; these hosts accept OAuth only, not a static bearer credential
Cursor (landscape)Unknownresearch-onlynone claimedrecipePromoted by its trial record under docs/trials/, after the Claude Code trial
execbound-client over HTTP (Python) (landscape)Nativefixture-tested: tests/test_client_package.py::test_waits_for_approval_then_progresses_the_same_intent, tests/test_demo_driver.py::test_the_driver_runs_all_six_beats_from_the_private_directoryexecbound 0.1.0, sdk 0.1.0, protocol HTTP v1recipeThe boundary beat is the bypass test: the agent holds the gateway credential and nothing else; a host that can reach the upstream credential is outside this row
MCP with the maintained 1.30 client (landscape)Nativefixture-tested: tests/test_mcp_surface.py::test_actual_maintained_mcp_clientexecbound 0.1.0, sdk 1.30.0, protocol 2025-11-25recipeHash-locked legacy client environment (tests/mcp-legacy.txt); static bearer only
MCP with the official Python SDK (landscape)Nativefixture-tested: tests/test_mcp_surface.py::test_current_mcp_pending_identity_switch_and_http_retry, tests/test_examples.py::test_mcp_example_completes_the_same_flow_through_the_sdkexecbound 0.1.0, sdk 2.2.0, protocol 2026-07-28recipeStatic bearer credential per host; there is no MCP authorization server yet
OpenAI Agents SDK tool example (landscape)Unknownresearch-onlynone claimedrecipeResearch-only until the example runs in CI against a stub model runner
Tines governed-action story (landscape)Advisoryfixture-tested: tests/test_tines_story.py::test_the_rendered_wire_body_is_one_the_gateway_acceptsexecbound 0.1.0, host Tines schema 30, lib 95recipeThe committed export was imported into a Tines tenant and fired against the hosted gateway at 7e4ac15: the chain reached the gateway, the body parsed as an ActionRequest and the answer was reported; Only the refusal branch has run, because the probe used a placeholder credential; allow, deny, approval from a phone, the 429 retry and the polling loop are unverified, so the row is not marked platform-validated; Advisory rather than Native: the story calls ExecBound voluntarily and nothing forces the call, so a story that skips it is not governed by anything

Gate

EntryModeEvidenceTested versionsRecipeLimits
Arcade Logic Extension (landscape)Advisoryplatform-validated: trial recordexecbound 0.1.0, host arcade-cloud-2026-09-18, sdk Github 5.0.0none yetAdvisory, not the Integrated the design targets: failing closed is a customer setting the extension cannot read, and a post hook is a runtime report not a receipt, so no settlement rises above tier ASSERTED; One live playground call on 18 September ran the whole chain, so the grant, the report window, the asserted settlement and an administrator's attested correction are measured rather than claimed; A settlement from a vendor success ran only against the hook process on loopback: a claimed incident must occupy one of the tool's declared inputs and SetStarred has no spare one; Mode is kept per action path, so an ungoverned toolkit stays Unknown
External execution checkpoint (landscape)Integratedfixture-tested: tests/test_checkpoint.py::test_gc1_a_deployed_checkpoint_answers_with_a_grant_and_dispatches_nothing, tests/test_checkpoint.py::test_gc5_a_denied_checkpoint_grants_nothing_and_replays_to_the_same_decisionexecbound 0.1.0, protocol checkpoint v1recipeEnforced only for the tested profile: the executor's own control point must block execution, bind the exact request and report; an unreported grant is swept to uncertainty and never refunded

Monitor

EntryModeEvidenceTested versionsRecipeLimits
Coding-agent MCP proxy (landscape)Unknownresearch-onlynone claimednone yetSpike on #230: a local MCP proxy that turns a coding agent's tool calls into observations; not started
Entra Agent ID via Graph (Scout) (landscape)Observedfixture-tested: tests/test_scout_collection.py::test_a_run_acquires_one_token_and_then_only_reads, tests/test_scout_run.py::test_a_run_probes_records_and_retains_only_allowlisted_metadataexecbound 0.1.0recipeThe collector and Agents page are implemented; docs/SCOUT.md records a September 18 founder-lab probe, but no complete versioned trial record promotes this row; Inherited allAllowed permissions, real-agent activity attribution and populated customer directories were not exercised by the lab probe; Azure RBAC and role-bearing group paths remain gaps; Directory reach is evidence of possible authority, not execution prevention; a principal binding governs only its path through ExecBound
CrowdStrike Falcon feed (Edge) (landscape)Unknownresearch-onlynone claimednone yetBrief written September 17, 2026 (#229); built after the raise with a design partner
Tines discovery and collection (landscape)Observedfixture-tested: tests/test_tines_collection.py::test_td1_probe_records_every_capability_and_retains_nothing_elseexecbound 0.1.0, protocol monitor events v1recipeAllowlisted story, action and credential metadata; a September 16 live inventory probe is recorded in docs/TINES_MONITORING.md, while audit and AI-audit collection lack the required account plan and remain fixture-tested
Tines instrumented stories (intake) (landscape)Observedfixture-tested: tests/test_monitoring_http.py::test_event_to_finding_and_admin_ack_preserves_execution_stateexecbound 0.1.0, protocol monitor events v1recipeA live Tines story delivered synthetic events on September 14, 2026; the row stays fixture-tested until a trial record in the interview format is written; Telemetry only: observations and findings never authorize, settle or consume limits

Reading a row

Versions are what was tested, never "latest". Limits are one line and concrete. The evidence column names the CI tests or the trial record behind the row; a row with none is research-only and says so. No runtime is named negatively: a host without a row is a candidate whose trial has not been run.