Integrations and the enforcement modes
How an agent host, a workflow engine or a feed connects to ExecBound, and, on every row, what that path enforces and how we know. The three tables are rendered from integrations/manifest.json and never edited by hand, and tests/test_integrations_manifest.py refuses a manifest whose claims the repository does not back, so every row states its tested version and whether its path is enforced or advisory by machine rather than by memory.
Three placements
- Execute: an agent asks ExecBound to act. The HTTP client, MCP hosts, the SDK tool examples and the Tines governed-action story.
- Gate: a workflow keeps its own connector and asks for a plan-bound decision before it acts. The external execution checkpoint and the Arcade Logic Extension.
- Monitor: feeds. Tines instrumented stories and collection and Entra Agent ID from Scout, and two planned and not built: a CrowdStrike Falcon feed and a coding-agent proxy.
Enforcement modes
The mode is kept per action path, never per vendor.
| Mode | Required evidence | Permitted claim |
|---|---|---|
| Native | Agent has only its gateway identity; credentials inaccessible; all protected operations traverse executor; bypass tests fail | Enforced for the documented protected paths |
| Integrated | Existing control point blocks execution, binds the exact request, fails closed, protects credentials, participates in state and receipts | Enforced only for the integration profile and routes tested |
| Embedded | Hook/SDK cannot be removed or bypassed by the protected agent; secrets and configuration are isolated | Enforced only within the proven runtime boundary |
| Advisory | Decision can be skipped, hook bypassed, or upstream credential used directly | Recommendation or would-have decision |
| Observed | Telemetry only | Visibility without action prevention |
| Unknown | Insufficient or stale evidence about the path | Coverage unknown |
Evidence states
- research-only: a recipe or a design exists; nothing has been run and recorded. The row shows mode Unknown, because the mode table defines Unknown as insufficient evidence; the designed mode appears only once the row is fixture-tested or better.
- fixture-tested: CI runs the path against synthetic fixtures at a pinned version; the row names the test node ids and the versions it pins.
- platform-validated: a named, dated trial against the real host or product, recorded under
docs/trials/with the host and version, operating system, transport, MCP client, SDK and protocol versions, gateway commit, fixture seed, the scenarios and the exact results, and the failures and limits as observed.
A row moves up by evidence and only by evidence: a test that runs in CI promotes research-only to fixture-tested, and a trial record promotes it to platform-validated. A newer host version is not claimed until it is re-trialled; the row keeps the version it was recorded at. Commercially backed connectors are a separate offering; this page records evidence and makes no commercial promise.
Execute
| Entry | Mode | Evidence | Tested versions | Recipe | Limits |
|---|---|---|---|---|---|
| Claude Agent SDK tool example | Native | fixture-tested: tests/test_sdk_examples.py::test_the_sdk_tool_example_lists_then_waits_for_a_person_and_acts_once[claude-agent-sdk], tests/test_demo_command.py::test_the_beats_run_without_an_admin_credential_and_take_the_origin_from_the_environment | execbound 0.1.0, sdk 0.2.153, protocol HTTP v1 | recipe | A scripted caller stands in for Claude Code and reaches the tools over the SDK's in-process MCP server; the Claude Code CLI itself is not run; The scripted calls are fixed: the script lists the space's actions, then asks for the action the listing names; no model chooses from the listing; The boundary beat is the bypass test: the agent holds the gateway credential and nothing else; a host that gives the model another path to the provider is outside this row |
| Claude Code | Unknown | research-only | none claimed | recipe | Promoted by its trial record under docs/trials/ (the named host trial) |
| Claude Desktop and claude.ai connectors | Unknown | research-only | none claimed | none yet | Waits for the MCP authorization server; these hosts accept OAuth only, not a static bearer credential |
| Cursor | Unknown | research-only | none claimed | recipe | Promoted by its trial record under docs/trials/, after the Claude Code trial |
| execbound-client over HTTP (Python) | Native | fixture-tested: tests/test_client_package.py::test_waits_for_approval_then_progresses_the_same_intent, tests/test_demo_command.py::test_the_beats_run_without_an_admin_credential_and_take_the_origin_from_the_environment | execbound 0.1.0, sdk 0.1.0, protocol HTTP v1 | recipe | The boundary beat is the bypass test: the agent holds the gateway credential and nothing else; a host that can reach the upstream credential is outside this row |
| MCP with the maintained 1.30 client | Native | fixture-tested: tests/test_mcp_surface.py::test_actual_maintained_mcp_client | execbound 0.1.0, sdk 1.30.0, protocol 2025-11-25 | recipe | Hash-locked legacy client environment (tests/mcp-legacy.txt); static bearer only |
| MCP with the official Python SDK | Native | fixture-tested: tests/test_mcp_surface.py::test_current_mcp_pending_identity_switch_and_http_retry, tests/test_examples.py::test_mcp_example_completes_the_same_flow_through_the_sdk | execbound 0.1.0, sdk 2.3.0, protocol 2026-07-28 | recipe | Static bearer credential per host; there is no MCP authorization server yet |
| Microsoft Defender for Endpoint as a security signal producer | Integrated | platform-validated: trial record | execbound 0.1.0, host Defender for Endpoint API 2026-10-01/03; Tines schema 30, lib 97, runtime 88, sdk 0.1.0, protocol security-signal v1 | recipe | Evidence into Execute decisions, not a placement of its own: the gateway decides, through the operator's reviewed mapping of Defender's risk score; Integrated only in that a missing, stale, unmapped or revoked verdict fails closed and a changed one cancels an approval; a wrong verdict from Defender is enforced as given; The machines API supplies its current stored verdict but no sensor liveness, so the source never attests clean and a quiet host reads no_detection; Live lab trial: None and Medium scores, baseline and signal, hard deny, missing/stale/revoked evidence, approval re-attestation, console evidence, offline replay, and a resolved alert's Medium-to-None drop sending a request to review; The committed Tines story reached the hosted gateway for the baseline, quiet and compromised hosts, on a synthetic tenant with the protected mock endpoint; the High band, sensor liveness and real endpoint isolation are not established |
| OpenAI Agents SDK tool example | Native | fixture-tested: tests/test_sdk_examples.py::test_the_sdk_tool_example_lists_then_waits_for_a_person_and_acts_once[openai-agents], tests/test_demo_command.py::test_the_beats_run_without_an_admin_credential_and_take_the_origin_from_the_environment | execbound 0.1.0, sdk 0.22.2, protocol HTTP v1 | recipe | A scripted model stands in for the OpenAI model; the Runner, the function tools and the tools' results are the SDK's own; The scripted calls are fixed: the script lists the space's actions, then asks for the action the listing names; no model chooses from the listing; The boundary beat is the bypass test: the agent holds the gateway credential and nothing else; a host that gives the model another path to the provider is outside this row |
| Tines governed-action story | Advisory | platform-validated: trial record | execbound 0.1.0, host Tines schema 30, lib 96, runtime 88 | recipe | Recorded trial: allow, deny, approval/refusal, same-reference retry, pending polling and wait-boundary resume ran in Tines; the AI caller returned allow, deny and pending; independent protected-mock journals corroborated outcomes; Shared-impact follow-up: ten Tines and ten second-agent HTTP actions filled one tenant limit; both overflows were denied and retries retained twenty charges and one mock mutation per successful operation; Expiry and malformed-target rejection passed on the hosted pilot; controlled Tines 503, 429-exhaustion and DNS faults exercised bounded retries and the explicit-uncertainty correction; Recovery at a513c8f: dropped response after mock effect, corrected 502 uncertainty and same-reference recovery retained one mutation and charge; alternate-story provider calls returned 401 and its gateway call remained denied; Signed-in Android approval passed; cold signed-out return and gateway-to-provider loss remain separate; the endpoint provider is a protected mock, and the pilot has no declared dispatch precondition; Advisory rather than Native: the story calls ExecBound voluntarily and nothing forces the call, so a story that skips it is not governed by anything |
Gate
| Entry | Mode | Evidence | Tested versions | Recipe | Limits |
|---|---|---|---|---|---|
| Arcade Logic Extension | Advisory | platform-validated: trial record | execbound 0.1.0, host arcade-cloud-2026-09-18, sdk Github 5.0.0 | recipe | Advisory, not the Integrated the design targets: failing closed is a customer setting the extension cannot read, and a post hook is a runtime report not a receipt, so no settlement rises above tier ASSERTED; One live playground call on 18 September ran the whole chain, so the grant, the report window, the asserted settlement and an administrator's attested correction are measured rather than claimed; A settlement from a vendor success ran only against the hook process on loopback: a claimed incident must occupy one of the tool's declared inputs and SetStarred has no spare one; Mode is kept per action path, so an ungoverned toolkit stays Unknown |
| External execution checkpoint | Integrated | fixture-tested: tests/test_checkpoint.py::test_gc1_a_deployed_checkpoint_answers_with_a_grant_and_dispatches_nothing, tests/test_checkpoint.py::test_gc5_a_denied_checkpoint_grants_nothing_and_replays_to_the_same_decision | execbound 0.1.0, protocol checkpoint v1 | recipe | Enforced only for the tested profile: the executor's own control point must block execution, bind the exact request and report; an unreported grant is swept to uncertainty and never refunded |
| Tines Gate story | Advisory | platform-validated: trial record | execbound 0.1.0, host Tines schema 30, lib 95, runtime 88 | recipe | Cooperative: any Tines story holding execbound_gate_vendor can call the vendor directly, without asking ExecBound; the trial proved this bypass, which is the reason Gate is Advisory rather than Integrated; The signing credential cannot be host-restricted; any story in the team holding execbound_gate_signing can produce a valid attestation for any grant it can read; Principal separation is owner provisioning, not a control the seed ships with: the trial found the Gate credential reaching the Execute mapping until two Cedar forbids were activated by hand; Mock vendor only: the protected mock signs journals with an HMAC key in the gateway's own configuration; no real vendor was exercised |
Monitor
| Entry | Mode | Evidence | Tested versions | Recipe | Limits |
|---|---|---|---|---|---|
| Coding-agent MCP proxy | Unknown | research-only | none claimed | none yet | Spike: a local MCP proxy that turns a coding agent's tool calls into observations; not started |
| Entra Agent ID via Graph (Scout) | Observed | fixture-tested: tests/test_scout_collection.py::test_a_run_acquires_one_token_and_then_only_reads, tests/test_scout_run.py::test_a_run_probes_records_and_retains_only_allowlisted_metadata | execbound 0.1.0 | recipe | The collector and Agents page are implemented; the Entra guide records a September 18 lab probe, but no complete versioned trial record promotes this row; Inherited allAllowed permissions, real-agent activity attribution and populated customer directories were not exercised by the lab probe; Azure RBAC and role-bearing group paths remain gaps; Directory reach is evidence of possible authority, not execution prevention; a principal binding governs only its path through ExecBound |
| CrowdStrike Falcon feed (Edge) | Unknown | research-only | none claimed | none yet | Not built; planned |
| Tines discovery and collection | Observed | fixture-tested: tests/test_tines_collection.py::test_td1_probe_records_every_capability_and_retains_nothing_else | execbound 0.1.0, protocol monitor events v1 | recipe | Allowlisted story, action and credential metadata; live inventory ran on September 16 and in the September 26 Monitor trial, which also reconciled coverage against a registered source; Audit and AI-audit collection lack the required account plan and remain fixture-tested |
| Tines instrumented stories (intake) | Observed | platform-validated: trial record | execbound 0.1.0, host Tines schema 30, lib 97, runtime 88, protocol monitor events v1 | recipe | Recorded trial: success, error and unknown results, a duplicate retry, a heartbeat stopped until stale and resumed, an unreachable intake, rotation past the grace window, coverage and revocation, all from a real Tines story; Findings delivery: signed webhooks were qualified against a Tines webhook on 18 October 2026, sent by a local monitor-process --deliver; email, Slack, Teams and hosted delivery are built, not yet qualified against a real receiver; Sources are issued from the command line for at most 24 hours, so ongoing instrumentation needs a daily rotation; the trial ran for about forty minutes against a local intake behind a quick tunnel; Telemetry only: observations and findings never authorize, settle or consume limits; a reported result is the story's account of an effect, not evidence of it, and the trial's vendor was a loopback stub |
Executors
An executor that ExecBound dispatches to speaks the executor protocol, and its evidence route is that protocol's conformance module, execbound_protocol.conformance. Run against an executor with the published vectors, it checks the transaction the specification requires: one mutation at most, the retained record on a repeat, a conflict for a changed command, VERSION_MISMATCH with no mutation, and a cancellation that holds. The two protected mocks pass it in CI (tests/test_executor_protocol_conformance.py); they are the reference implementations rather than integrations, so they have no row above. An external executor that keeps its own vendor credential and reports to ExecBound, such as a Tines Gate story, has the checkpoint report's module instead, execbound_protocol.checkpoint_conformance: given the reports the executor writes for the published checkpoint report vectors, it reads each as the outcome route does and checks what it would settle (tests/test_checkpoint_report_conformance.py, and tests/test_checkpoint_report_server.py for the route). A third-party executor that passes either module in a test this repository runs can be listed as fixture-tested for that path. None is listed yet.
Reading a row
Versions are what was tested, never "latest". Limits are one line and concrete. The evidence column names the CI tests or the trial record behind the row; a row with none is research-only and says so. No runtime is named negatively: a host without a row is a candidate whose trial has not been run.