@cirvix_ai/agent-control 0.1.2 → 0.1.5

package/src/core/graph.mjs

@@ -0,0 +1,270 @@
+/**
+ * The multi-agent relationship graph.
+ *
+ * delegation.mjs already records every edge — each grant is "issuer delegated
+ * this scope to subject" — but only ever answers one question: may THIS call
+ * proceed. That is the right question at execution time and the wrong one
+ * afterwards, when somebody is trying to find out how an agent nobody
+ * provisioned for production ended up able to reach it.
+ *
+ * This module answers the second kind of question. It reads the broker's
+ * inventory and nothing else, so it cannot disagree with enforcement about who
+ * delegated what — there is one source of edges.
+ *
+ * TENANCY IS A CONSTRUCTOR ARGUMENT, NOT A FILTER YOU REMEMBER TO APPLY
+ * --------------------------------------------------------------------
+ * buildGraph() takes the tenant and drops everything else before any query
+ * runs. A graph is exactly the shape of an answer to "what can reach
+ * production", so a traversal that wanders into another tenant's edges does
+ * not leak a row — it leaks the topology of someone else's estate, which is
+ * worse and harder to notice. Filtering at construction means no query can
+ * forget to do it, and the tests assert a cross-tenant edge is absent from the
+ * graph rather than merely excluded from the result.
+ *
+ * NOT A GRAPH DATABASE
+ * --------------------
+ * Adjacency maps over an array that is already in memory. These estates are
+ * tens to low thousands of edges; a traversal over that is microseconds, and
+ * introducing a graph store would add an operational dependency to answer
+ * questions a Map already answers.
+ */
+
+import { scopePermits, intersectScopes } from "./delegation.mjs";
+
+/**
+ * Builds a directed graph from a broker inventory.
+ *
+ * Revoked and expired grants are excluded by default: an edge that cannot
+ * authorise anything is not a path, and including it would make every query
+ * over-report. `includeInactive` keeps them for forensics, where "who COULD
+ * have reached this last Tuesday" is the actual question.
+ */
+export function buildGraph(inventory = [], { tenant = undefined, includeInactive = false, now = Date.now() } = {}) {
+  const scoped = inventory.filter((g) => {
+    if (tenant !== undefined && g.tenant !== tenant) return false;
+    if (includeInactive) return true;
+    if (g.revoked) return false;
+    if (g.expiresAt && Date.parse(g.expiresAt) <= now) return false;
+    return true;
+  });
+
+  const nodes = new Map();
+  const node = (id) => {
+    if (!id) return null;
+    if (!nodes.has(id)) nodes.set(id, { id, tenant: tenant === undefined ? null : tenant, roots: 0, out: [], in: [] });
+    return nodes.get(id);
+  };
+
+  const edges = [];
+  for (const g of scoped) {
+    const subject = node(g.subject);
+    if (!subject) continue;
+    if (g.issuer === null) {
+      // A root grant is authority the platform handed the agent directly. It
+      // is a property of the node, not an edge from nobody.
+      subject.roots += 1;
+      subject.rootScope = subject.rootScope ? intersectScopes(subject.rootScope, g.scope) : g.scope;
+      continue;
+    }
+    const issuer = node(g.issuer);
+    const edge = {
+      id: g.id, from: g.issuer, to: g.subject, scope: g.scope,
+      depth: g.depth, revoked: Boolean(g.revoked), expiresAt: g.expiresAt ?? null,
+    };
+    edges.push(edge);
+    issuer.out.push(edge);
+    subject.in.push(edge);
+  }
+
+  return { tenant: tenant === undefined ? null : tenant, nodes, edges };
+}
+
+/**
+ * Everything `from` can reach, and by which path.
+ *
+ * Breadth-first so the first path found to a node is the shortest one, which
+ * is the path a reader wants to see. Scope is intersected along the way: an
+ * agent two delegations deep holds the intersection of both, never the union,
+ * which is the same rule enforcement applies.
+ */
+export function reach(graph, from, { maxDepth = 8 } = {}) {
+  const start = graph.nodes.get(from);
+  if (!start) return [];
+
+  const seen = new Set([from]);
+  const out = [];
+  let frontier = [{ id: from, path: [], scope: start.rootScope ?? null }];
+
+  for (let depth = 0; depth < maxDepth && frontier.length; depth++) {
+    const next = [];
+    for (const cur of frontier) {
+      const node = graph.nodes.get(cur.id);
+      if (!node) continue;
+      for (const edge of node.out) {
+        if (seen.has(edge.to)) continue;
+        seen.add(edge.to);
+        const scope = cur.scope ? intersectScopes(cur.scope, edge.scope) : edge.scope;
+        const entry = { agent: edge.to, depth: depth + 1, path: [...cur.path, edge.id], via: [...cur.path, edge.id].length, scope };
+        out.push(entry);
+        next.push({ id: edge.to, path: entry.path, scope });
+      }
+    }
+    frontier = next;
+  }
+  return out;
+}
+
+/**
+ * The scope actually held at the end of a specific path.
+ *
+ * Intersected edge by edge, starting from the origin's root authority, which
+ * is the same narrowing enforcement applies.
+ */
+export function scopeAlong(graph, origin, path) {
+  let scope = graph.nodes.get(origin)?.rootScope ?? null;
+  for (const edgeId of path) {
+    const edge = graph.edges.find((e) => e.id === edgeId);
+    if (!edge) return null;
+    scope = scope ? intersectScopes(scope, edge.scope) : edge.scope;
+  }
+  return scope;
+}
+
+/**
+ * Which agents can reach this action/resource, directly or by delegation.
+ *
+ * WHY THIS ENUMERATES EVERY PATH RATHER THAN USING reach()
+ * -------------------------------------------------------
+ * reach() is breadth-first with one `seen` set, so an agent is claimed by
+ * whichever path arrives first — the SHORTEST one. For "how do I get there"
+ * that is the right answer. For "can this agent reach production" it is
+ * actively wrong, because the shortest path is not the most permissive one.
+ *
+ * The estate in the tests has exactly this shape: deployer is reachable at
+ * depth 2 through researcher (fs.read only) and through coder (which carries
+ * deploy.production). Breadth-first found the researcher path first, computed
+ * a scope without deploy.production, and concluded deployer could not reach
+ * production. It can. A security query that under-reports is worse than one
+ * that is slow, so this walks every path and asks whether ANY of them still
+ * permits the call after all its narrowings.
+ */
+export function whoCanReach(graph, { action, resource }) {
+  const hits = [];
+  for (const [id, node] of graph.nodes) {
+    if (node.rootScope && scopePermits(node.rootScope, { action, resource })) {
+      hits.push({ agent: id, via: "root", depth: 0, path: [] });
+      continue;
+    }
+    let best = null;
+    for (const [origin, originNode] of graph.nodes) {
+      if (origin === id || !originNode.rootScope) continue;
+      for (const path of paths(graph, origin, id)) {
+        const scope = scopeAlong(graph, origin, path);
+        if (!scope || !scopePermits(scope, { action, resource })) continue;
+        /* Report the shortest permitting path, not merely the first found —
+           it is the one someone has to go and revoke. */
+        if (!best || path.length < best.path.length) best = { agent: id, via: origin, depth: path.length, path };
+      }
+    }
+    if (best) hits.push(best);
+  }
+  return hits;
+}
+
+/**
+ * Delegation paths from `from` to `to`.
+ *
+ * All of them, not the shortest. Two routes to the same authority is exactly
+ * the finding worth surfacing — revoking one and believing the path is closed
+ * is how an estate keeps a capability nobody thinks it has.
+ */
+export function paths(graph, from, to, { maxDepth = 8 } = {}) {
+  const found = [];
+  const walk = (cur, trail, visited) => {
+    if (trail.length > maxDepth) return;
+    if (cur === to && trail.length) { found.push([...trail]); return; }
+    const node = graph.nodes.get(cur);
+    if (!node) return;
+    for (const edge of node.out) {
+      if (visited.has(edge.to)) continue;      // no cycles
+      visited.add(edge.to);
+      walk(edge.to, [...trail, edge.id], visited);
+      visited.delete(edge.to);
+    }
+  };
+  walk(from, [], new Set([from]));
+  return found;
+}
+
+/**
+ * Agents that share a capability, grouped by the capability.
+ *
+ * "Which agents share a sensitive capability" — the shared-credential
+ * question. Only capabilities held by more than one agent are returned;
+ * a capability with a single holder is not a sharing risk and would bury
+ * the ones that are.
+ */
+export function sharedCapability(graph) {
+  const holders = new Map();
+  const note = (cap, agent) => {
+    if (!holders.has(cap)) holders.set(cap, new Set());
+    holders.get(cap).add(agent);
+  };
+  /* A scope is {actions, resources}, NOT a flat list of capability strings.
+     Iterating the scope object directly yielded nothing and, worse, passing a
+     flat array anywhere near normalizeScope() turns it into ["*"] on BOTH
+     axes — absent means unconstrained — so an array-shaped scope reads as
+     unlimited authority. Actions are the axis that names a capability. */
+  const actionsOf = (scope) => (Array.isArray(scope?.actions) ? scope.actions : []);
+  for (const [id, node] of graph.nodes) {
+    for (const cap of actionsOf(node.rootScope)) note(String(cap), id);
+  }
+  for (const e of graph.edges) for (const cap of actionsOf(e.scope)) note(String(cap), e.to);
+
+  return [...holders.entries()]
+    .filter(([, set]) => set.size > 1)
+    .map(([capability, set]) => ({ capability, agents: [...set].sort() }))
+    .sort((a, b) => b.agents.length - a.agents.length || a.capability.localeCompare(b.capability));
+}
+
+/** Who delegated authority to this agent, nearest first. */
+export function delegatedBy(graph, agent) {
+  const node = graph.nodes.get(agent);
+  if (!node) return [];
+  return node.in.map((e) => ({ from: e.from, grant: e.id, scope: e.scope, depth: e.depth }));
+}
+
+/**
+ * Graphviz export, for the CLI and for anyone who wants a picture.
+ *
+ * Machine-readable is `summary()`; this is the human one. Root authority is
+ * drawn as a node attribute rather than an edge from a phantom node, because
+ * inventing a "platform" node would put something in the picture that does not
+ * exist in the model.
+ */
+export function toDot(graph, { title = "cirvix agents" } = {}) {
+  const esc = (s) => String(s).replace(/"/g, '\\"');
+  const lines = [`digraph "${esc(title)}" {`, "  rankdir=LR;", '  node [shape=box, style=rounded, fontname="monospace"];'];
+  for (const [id, node] of graph.nodes) {
+    const rooted = node.roots > 0;
+    lines.push(`  "${esc(id)}" [label="${esc(id)}${rooted ? "\\n(root authority)" : ""}"${rooted ? ', peripheries=2' : ""}];`);
+  }
+  for (const e of graph.edges) {
+    const label = (e.scope?.actions ?? []).join(", ");
+    lines.push(`  "${esc(e.from)}" -> "${esc(e.to)}" [label="${esc(label)}"${e.revoked ? ", style=dashed" : ""}];`);
+  }
+  lines.push("}");
+  return lines.join("\n");
+}
+
+/** A compact machine-readable view for the API and the dashboard. */
+export function summary(graph) {
+  return {
+    tenant: graph.tenant,
+    agents: [...graph.nodes.values()].map((n) => ({
+      id: n.id, rootAuthority: n.roots > 0, delegationsIn: n.in.length, delegationsOut: n.out.length,
+    })),
+    edges: graph.edges.map((e) => ({ from: e.from, to: e.to, grant: e.id, scope: e.scope, revoked: e.revoked })),
+    shared: sharedCapability(graph),
+  };
+}

package/src/core/guard.mjs

@@ -29,7 +29,9 @@ import { classify } from "./risk.mjs";
 import { classifyTool, extractCommand, publicToolName } from "./normalize.mjs";
 import { scan as scanSecrets } from "./secret-detect.mjs";
 import { applyDelegation } from "./delegation.mjs";
+import { assessAuthority, applyAuthority } from "./authority.mjs";
 import { applyEntitlements } from "./entitlement-gate.mjs";
+import { SessionTaint, assessTrifecta, applyTrifecta } from "./trifecta.mjs";
 
 /**
  * A refusal the agent can read and plan around.
@@ -176,6 +178,12 @@ export class Guard {
     runId = null,
     riskFloor = "high",
     delegation = null,
+    /* Mission-scoped authority. Absent by default, and absent means INERT —
+       not "deny everything". Authority is subtractive: it can take away what
+       policy allows and can never add to it, so a Guard built without a
+       mission behaves exactly as before. See core/authority.mjs. */
+    missions = null,
+    mission = null,
     /* Commercial enforcement. All three default to absent, so a Guard built
        without them behaves exactly as before — which is what keeps the SDK's
        library callers and the shared conformance fixture working unchanged.
@@ -192,6 +200,9 @@ export class Guard {
     this.secrets = secrets;
     /** DelegationBroker, when agent-to-agent delegation is in use. */
     this.delegation = delegation;
+    /** MissionRegistry, and/or a single mission this Guard always acts under. */
+    this.missions = missions;
+    this.mission = mission;
     this.licence = licence;
     this.meter = meter;
     this.agents = agents;
@@ -200,12 +211,20 @@ export class Guard {
     this.runId = runId;
     /** Risk level at or above which an unnamed call is escalated to approval. */
     this.riskFloor = riskFloor;
-    /** Set once this session reads secret-shaped material. */
-    this.touchedSecret = false;
+    /** Sequence taint tracking for Lethal Trifecta. */
+    this.taint = new SessionTaint();
     this.stats = { calls: 0, permitted: 0, denied: 0, held: 0, leaks: 0, latencyTotal: 0 };
     this.nextId = 1;
   }
 
+  get touchedSecret() {
+    return this.taint.touchedSecret;
+  }
+
+  set touchedSecret(value) {
+    this.taint.touchedSecret = value;
+  }
+
   /**
    * Decides one call, and brokers any secret handles it carries.
    *
@@ -215,7 +234,8 @@ export class Guard {
    *
    * @returns {Promise<{decision:object, record:object, args:any}>}
    */
-  async authorize({ tool, server = null, args = {}, delegation = null, agent = null }) {
+  async authorize({ tool, server = null, args, arguments: callArguments, delegation = null, agent = null }) {
+    args = args ?? callArguments ?? {};
     const action = actionForTool(server, tool);
     const resource = resourceForCall(args);
     // A caller may act as a specific agent per call — a gateway serving several
@@ -271,7 +291,7 @@ export class Guard {
       secrets: { detected: scanned.length },
     };
 
-    const decision = evaluate(
+    let decision = evaluate(
       { agent: caller, action, resource, context },
       this.rules,
       { cwd: this.cwd },
@@ -308,6 +328,88 @@ export class Guard {
       resource: decision.resource ?? resource,
     });
 
+    /*
+     * AUTHORITY RUNS HERE, ON THE SAME PATH AS EVERYTHING ELSE.
+     *
+     * Mission, capability, constraint and expiry are evaluated for every call,
+     * not only for the ones a caller remembers to check. Placing it beside
+     * delegation is deliberate: both answer "does this principal actually hold
+     * the authority it is exercising", both can only narrow, and both have to
+     * be on the ONE path that `guard.wrap()`, the MCP gateway and the socket
+     * all go through. The three bypasses documented above this line were all
+     * the same mistake — a check that lived on one surface and not the others —
+     * and an authority layer with that shape would be worse than none, because
+     * the console would show a boundary the runtime was not enforcing.
+     *
+     * `assessAuthority` is pure. It reads the mission and reports; it does not
+     * spend the budget. Usage is recorded below and only for a call that was
+     * actually permitted, so a refused call cannot exhaust the allowance it was
+     * refused under — otherwise every constraint doubles as a denial-of-service
+     * against the agent's real work.
+     */
+    const activeMission =
+      this.mission ?? (this.missions ? this.missions.forAgent(caller) : null);
+
+    const authorityAssessment = assessAuthority(
+      {
+        agent: caller,
+        action,
+        resource: decision.resource ?? resource,
+        tool,
+        server,
+        destination: destinationFor(decision.resource ?? resource, args),
+        environment: this.environment,
+        costUsd: args?.costUsd ?? 0,
+        delegating: Boolean(delegation),
+      },
+      activeMission,
+    );
+
+    const authorityContext = applyAuthority(decision, authorityAssessment);
+
+    /*
+     * An attempt is recorded whether or not authority is what refused it.
+     *
+     * A call policy already denied is still an agent reaching outside its
+     * boundary, and if only authority-attributed refusals were counted an
+     * agent could probe the boundary for free by choosing actions policy
+     * denies anyway. The benchmark scores attempts, not attributions.
+     */
+    if (this.missions && authorityAssessment.applicable && !authorityAssessment.authorized) {
+      this.missions.recordEscape({
+        missionId: activeMission?.id ?? null,
+        agent: caller,
+        kind: authorityAssessment.escape?.kind ?? null,
+        stage: authorityAssessment.stage,
+        code: authorityAssessment.code,
+        action,
+        resource: decision.resource ?? resource,
+        tool,
+        reason: authorityAssessment.reason,
+        blocked: decision.verdict === "deny" || decision.verdict === "hold",
+      });
+    }
+
+    /*
+     * Sequence-aware enforcement (Lethal Trifecta) in Guard.
+     * Prevents untrusted content + sensitive data read + outbound egress.
+     */
+    const trifectaCall = {
+      action,
+      resource: decision.resource ?? resource,
+      tool,
+      server,
+      destination: destinationFor(decision.resource ?? resource, args),
+      environment: this.environment,
+      egress: this.isExternal(decision.resource ?? resource) ? "external" : "none",
+      timestamp: new Date().toISOString(),
+      sql: typeof args?.sql === "string" ? args.sql : typeof args?.query === "string" ? args.query : null,
+      secretsDetected: scanned.length,
+    };
+    const trifecta = assessTrifecta(trifectaCall, this.taint);
+    decision = applyTrifecta(decision, trifecta);
+    decision.trifecta = { complete: trifecta.complete, satisfied: trifecta.satisfied, imminent: trifecta.imminent };
+
     /*
      * THE COMMERCIAL GATE RUNS HERE TOO, NOT ONLY IN THE PIPELINE.
      *
@@ -391,7 +493,12 @@ export class Guard {
       // Who authorized this must be answerable after the fact, on every surface
       // — not only the one that happened to record it.
       ...(delegationContext ? { delegation: delegationContext } : {}),
+      // Authority is part of the record for the same reason delegation is:
+      // "who authorized this" must be answerable after the fact.
+      ...(authorityContext ? { authority: authorityContext } : {}),
+      ...(decision.escape ? { escape: decision.escape } : {}),
       ...(brokered.length ? { secrets: brokered, secrets_brokered: brokered } : {}),
+      ...(decision.trifecta ? { trifecta: decision.trifecta } : {}),
       // Findings never carry the value — see secret-detect.mjs.
       ...(scanned.length
         ? {
@@ -413,6 +520,13 @@ export class Guard {
     else if (decision.verdict === "hold") this.stats.held++;
     else {
       this.stats.permitted++;
+      // Budget and rate are consumed by calls that HAPPEN. See the note above
+      // `assessAuthority`: charging a refused call would let a blocked agent
+      // exhaust its own mission.
+      if (this.missions && activeMission) {
+        this.missions.record(activeMission.id, { costUsd: args?.costUsd ?? 0 });
+      }
+      this.taint.observeCall(trifectaCall, true);
       // Any successful read of secret-shaped material taints the session. A
       // brokered substitution deliberately does not: the agent never held the
       // material, which is the entire point of a handle.

package/src/core/intent.mjs

@@ -0,0 +1,166 @@
+/**
+ * Intent-Aware Agent Firewall.
+ *
+ * Implements: CAPABILITY + AUTHORITY + INTENT + CONTEXT = AUTHORIZED ACTION
+ *
+ * Rather than evaluating tools in isolation (`tool == allowed`), an agent's
+ * declared mission/purpose governs what it may reach for.
+ *
+ * Example:
+ *   Mission: "Fix checkout test failures"
+ *   Allowed: read source, run tests, modify checkout files
+ *   Suspicious: read production credentials, drop database, upload code to external IP
+ */
+
+import { RISK } from "./risk.mjs";
+
+/** Semantic categories of intent. */
+export const INTENT_CATEGORIES = {
+  TESTING: "testing",
+  DEVELOPMENT: "development",
+  MAINTENANCE: "maintenance",
+  REPORTING: "reporting",
+  DATABASE_ADMIN: "database_admin",
+  DEPLOYMENT: "deployment",
+  GENERAL: "general",
+};
+
+/** High-risk actions that require explicit intent alignment. */
+const RESTRICTED_ACTIONS = {
+  "secret:read": ["credential_management", "auth_setup"],
+  "db:drop": ["database_admin", "migration_rollback"],
+  "db:write": ["database_admin", "data_migration", "development"],
+  "shell:destructive": ["system_admin"],
+  "net:external_egress": ["data_sync", "api_integration", "deployment"],
+  "iam:modify": ["cloud_admin", "iam_setup"],
+};
+
+/**
+ * Classifies a declared intent string into dominant categories and allowed scopes.
+ */
+export function classifyIntent(intentText) {
+  if (!intentText || typeof intentText !== "string") {
+    return {
+      category: INTENT_CATEGORIES.GENERAL,
+      keywords: [],
+      sensitivityFloor: RISK.LOW,
+      allowedActions: ["*"],
+    };
+  }
+
+  const text = intentText.toLowerCase();
+  const keywords = text.match(/\b\w{3,}\b/g) ?? [];
+
+  if (/\b(test|spec|assert|coverage|jest|mocha|pytest|unit)\b/.test(text)) {
+    return {
+      category: INTENT_CATEGORIES.TESTING,
+      keywords,
+      sensitivityFloor: RISK.LOW,
+      disallowedActions: ["secret:read", "db:drop", "net:external_egress", "iam:modify"],
+      allowedActions: ["fs:read", "fs:write", "exec:test", "exec:dev"],
+    };
+  }
+
+  if (/\b(fix|bug|refactor|feature|implement|code|frontend|backend)\b/.test(text)) {
+    return {
+      category: INTENT_CATEGORIES.DEVELOPMENT,
+      keywords,
+      sensitivityFloor: RISK.LOW,
+      disallowedActions: ["secret:read", "db:drop", "iam:modify"],
+      allowedActions: ["fs:read", "fs:write", "exec:dev", "net:fetch"],
+    };
+  }
+
+  if (/\b(deploy|release|ship|staging|production|publish)\b/.test(text)) {
+    return {
+      category: INTENT_CATEGORIES.DEPLOYMENT,
+      keywords,
+      sensitivityFloor: RISK.HIGH,
+      disallowedActions: ["db:drop"],
+      allowedActions: ["fs:read", "net:external_egress", "exec:deploy"],
+    };
+  }
+
+  if (/\b(migrate|schema|table|sql|database|query|seed)\b/.test(text)) {
+    return {
+      category: INTENT_CATEGORIES.DATABASE_ADMIN,
+      keywords,
+      sensitivityFloor: RISK.HIGH,
+      disallowedActions: ["iam:modify"],
+      allowedActions: ["db:read", "db:write", "fs:read"],
+    };
+  }
+
+  return {
+    category: INTENT_CATEGORIES.GENERAL,
+    keywords,
+    sensitivityFloor: RISK.LOW,
+    disallowedActions: ["db:drop", "iam:modify"],
+    allowedActions: ["*"],
+  };
+}
+
+/**
+ * Evaluates whether a requested action aligns with the agent's declared intent.
+ *
+ * @param {Object} params
+ * @param {string} params.intent - Declared mission or task description
+ * @param {string} params.action - Canonical action identifier (e.g. "fs:read", "secret:read")
+ * @param {string} params.resource - Resource target (e.g. "/etc/passwd", "src/auth.ts")
+ * @param {string} params.tool - Tool name invoked
+ * @param {Object} params.context - Execution context
+ * @returns {{ aligned: boolean, intentScore: number, reason: string, category: string }}
+ */
+export function evaluateIntent({ intent, action, resource = "", tool = "", context = {} }) {
+  const classification = classifyIntent(intent);
+
+  // If action is explicitly restricted, verify if intent permits it
+  const restrictedFor = RESTRICTED_ACTIONS[action];
+  if (restrictedFor && !restrictedFor.includes(classification.category)) {
+    return {
+      aligned: false,
+      intentScore: 0.1,
+      reason: `Action '${action}' is restricted and outside declared mission '${intent}' (${classification.category})`,
+      category: classification.category,
+    };
+  }
+
+  // Check disallowed actions for this intent category
+  if (classification.disallowedActions?.includes(action)) {
+    return {
+      aligned: false,
+      intentScore: 0.2,
+      reason: `Action '${action}' conflicts with declared mission scope (${classification.category})`,
+      category: classification.category,
+    };
+  }
+
+  // Resource sensitivity check against intent
+  const isCredentialTarget = /(credential|\.env|id_rsa|secret|token|api[_-]?key|password)/i.test(resource);
+  if (isCredentialTarget && classification.category === INTENT_CATEGORIES.TESTING) {
+    return {
+      aligned: false,
+      intentScore: 0.15,
+      reason: `Agent attempted to access credentials ('${resource}') while declared mission is testing only`,
+      category: classification.category,
+    };
+  }
+
+  // Production database deletion check
+  const isDropTarget = /(drop\s+table|delete\s+from|truncate|rm\s+-rf\s+\/)/i.test(resource);
+  if (isDropTarget && classification.category !== INTENT_CATEGORIES.DATABASE_ADMIN) {
+    return {
+      aligned: false,
+      intentScore: 0.05,
+      reason: `Destructive action against '${resource}' requires explicit administrative mission`,
+      category: classification.category,
+    };
+  }
+
+  return {
+    aligned: true,
+    intentScore: 0.95,
+    reason: `Action '${action}' against '${resource || tool}' aligns with mission '${classification.category}'`,
+    category: classification.category,
+  };
+}