agentmandate 0.3.0__tar.gz → 0.3.2__tar.gz

{agentmandate-0.3.0 → agentmandate-0.3.2}/CHANGELOG.md

@@ -6,6 +6,25 @@ All notable changes to this project are documented here. The format follows
 
 ## Unreleased
 
+## 0.3.2 - 2026-07-28
+
+### Changed
+
+- The README scopes every finding to permitted reachability under the reviewed
+  manifest and bounded abstraction, rather than observed model behaviour or
+  undeclared downstream enforcement.
+- The roadmap makes external tool-graph validation a prerequisite for model
+  growth, then ranks bounded cardinality, reviewed resource relationships, and
+  non-monetary effect budgets as evidence-dependent candidates.
+
+## 0.3.1 - 2026-07-28
+
+### Changed
+
+- The README opens with the compound-authority problem in plain language and
+  separates per-call policy, reviewed decision evidence, and runtime-control
+  evidence without weakening their boundaries.
+
 ## 0.3.0 - 2026-07-28
 
 ### Added

{agentmandate-0.3.0 → agentmandate-0.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentmandate
-Version: 0.3.0
+Version: 0.3.2
 Summary: Compound-path and cross-release analysis of what an AI agent is permitted to do
 Project-URL: Homepage, https://github.com/mrwersa/agentmandate
 Project-URL: Repository, https://github.com/mrwersa/agentmandate
@@ -34,7 +34,7 @@ Description-Content-Type: text/markdown
 
 # AgentMandate
 
-> **Compound-path and cross-release analysis of what an AI agent is permitted to do.**
+> **What is your AI agent actually allowed to do?**
 
 [![PyPI](https://img.shields.io/pypi/v/agentmandate.svg)](https://pypi.org/project/agentmandate/)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%20--%203.14-blue.svg)](https://www.python.org/downloads/)
@@ -42,16 +42,30 @@ Description-Content-Type: text/markdown
 [![Coverage: 100%](https://img.shields.io/badge/coverage-100%25-brightgreen.svg)](#development)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-green.svg)](https://github.com/mrwersa/agentmandate/blob/main/LICENSE)
 
-Analyse what an AI agent is permitted to do, and what changed between two releases.
+A Python library and CLI that reads a short description of your agent's tools,
+called a **manifest**, and finds the limits it can slip past by combining
+actions that are each permitted on their own. It also tells you when a release
+widened what the agent can reach, before that release ships.
+
+Policy engines decide one call at a time. This looks at the whole tool graph
+offline, so it catches the gaps that only appear across a sequence.
+
+| What you run | Question it answers |
+|---|---|
+| Cedar, OPA, AgentCore Policy, AgentWard | May this agent make this call, right now? |
+| **AgentMandate** | **What can it reach by combining permitted calls, and did this release widen that?** |
+| [AgentVerity](https://github.com/mrwersa/agentverity) | Were the reviewed decision routes exercised repeatably? |
+| Your tests and runtime traces | Did the tools execute and the declared controls hold? |
 
 Imagine a payment-dispute agent that can open a case and issue a
 human-approved refund. Each refund is capped at 500 GBP per case, and the
 whole run is capped at 500 GBP. Release 2 adds one read-only tool:
 `search_cases`.
 
-That tool spends nothing. It does, however, give the agent more case bindings.
-Two separately valid refunds become reachable, so effective authority rises
-from 500 to 1,000 GBP even though every individual call still looks permitted.
+That tool spends nothing. It does, however, let the agent get hold of more
+cases, and the 500 GBP cap is measured *per case*. Two separately valid refunds
+become reachable under the manifest, so reachable extraction doubles to 1,000 GBP
+while every individual call still looks permitted.
 
 ![A read-only case search makes two approved refunds reachable and breaches the run limit](https://raw.githubusercontent.com/mrwersa/agentmandate/main/docs/assets/authority-path.svg)
 
@@ -255,6 +269,10 @@ The `lint` command deliberately overlaps the scanners above. A tool that reporte
 
 ## Scope
 
+Read every finding as **permitted by the reviewed manifest within this bounded
+abstraction**. It is not proof that the model will choose the path or that an
+undeclared downstream invariant will accept it.
+
 What this does not do, on purpose:
 
 - **No enforcement.** No proxy, no runtime interception, no blocking.
@@ -286,7 +304,7 @@ ruff check .
 
 ## Status
 
-Alpha, version 0.3.0. The authority model is the part most likely to change,
+Alpha, version 0.3.2. The authority model is the part most likely to change,
 because it has not yet been pointed at enough real tool graphs to know where it
 is too coarse. Issues describing a graph it models badly are the most useful
 thing you can file.

{agentmandate-0.3.0 → agentmandate-0.3.2}/README.md

@@ -1,6 +1,6 @@
 # AgentMandate
 
-> **Compound-path and cross-release analysis of what an AI agent is permitted to do.**
+> **What is your AI agent actually allowed to do?**
 
 [![PyPI](https://img.shields.io/pypi/v/agentmandate.svg)](https://pypi.org/project/agentmandate/)
 [![Python 3.10+](https://img.shields.io/badge/python-3.10%20--%203.14-blue.svg)](https://www.python.org/downloads/)
@@ -8,16 +8,30 @@
 [![Coverage: 100%](https://img.shields.io/badge/coverage-100%25-brightgreen.svg)](#development)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-green.svg)](https://github.com/mrwersa/agentmandate/blob/main/LICENSE)
 
-Analyse what an AI agent is permitted to do, and what changed between two releases.
+A Python library and CLI that reads a short description of your agent's tools,
+called a **manifest**, and finds the limits it can slip past by combining
+actions that are each permitted on their own. It also tells you when a release
+widened what the agent can reach, before that release ships.
+
+Policy engines decide one call at a time. This looks at the whole tool graph
+offline, so it catches the gaps that only appear across a sequence.
+
+| What you run | Question it answers |
+|---|---|
+| Cedar, OPA, AgentCore Policy, AgentWard | May this agent make this call, right now? |
+| **AgentMandate** | **What can it reach by combining permitted calls, and did this release widen that?** |
+| [AgentVerity](https://github.com/mrwersa/agentverity) | Were the reviewed decision routes exercised repeatably? |
+| Your tests and runtime traces | Did the tools execute and the declared controls hold? |
 
 Imagine a payment-dispute agent that can open a case and issue a
 human-approved refund. Each refund is capped at 500 GBP per case, and the
 whole run is capped at 500 GBP. Release 2 adds one read-only tool:
 `search_cases`.
 
-That tool spends nothing. It does, however, give the agent more case bindings.
-Two separately valid refunds become reachable, so effective authority rises
-from 500 to 1,000 GBP even though every individual call still looks permitted.
+That tool spends nothing. It does, however, let the agent get hold of more
+cases, and the 500 GBP cap is measured *per case*. Two separately valid refunds
+become reachable under the manifest, so reachable extraction doubles to 1,000 GBP
+while every individual call still looks permitted.
 
 ![A read-only case search makes two approved refunds reachable and breaches the run limit](https://raw.githubusercontent.com/mrwersa/agentmandate/main/docs/assets/authority-path.svg)
 
@@ -221,6 +235,10 @@ The `lint` command deliberately overlaps the scanners above. A tool that reporte
 
 ## Scope
 
+Read every finding as **permitted by the reviewed manifest within this bounded
+abstraction**. It is not proof that the model will choose the path or that an
+undeclared downstream invariant will accept it.
+
 What this does not do, on purpose:
 
 - **No enforcement.** No proxy, no runtime interception, no blocking.
@@ -252,7 +270,7 @@ ruff check .
 
 ## Status
 
-Alpha, version 0.3.0. The authority model is the part most likely to change,
+Alpha, version 0.3.2. The authority model is the part most likely to change,
 because it has not yet been pointed at enough real tool graphs to know where it
 is too coarse. Issues describing a graph it models badly are the most useful
 thing you can file.

{agentmandate-0.3.0 → agentmandate-0.3.2}/ROADMAP.md

@@ -7,15 +7,16 @@ runtime proxy or general agent-security scanner.
 
 This is direction, not a release promise.
 
-## Now: trustworthy authority analysis
+## Current foundation: trustworthy authority analysis
 
-Version 0.2 makes the existing gate dependable:
+Version 0.3.2 makes the existing gate dependable:
 
 - fail-closed replay when control evidence is missing
 - tool-contract and run-limit comparison across releases
 - one search depth on both sides of a diff
 - safe ingestion of untrusted MCP catalogues
 - explicit handling of incomparable currencies and different agents
+- reviewed test obligations reconciled against current reachable authority
 
 ## Next: easier adoption
 
@@ -35,6 +36,39 @@ new value remains the authority graph and its counterexamples.
 
 ## Then: widen the model where evidence demands it
 
+Do not implement every candidate below in parallel. First collect tool graphs
+from independent users and identify which abstraction forces them to distort a
+real control. Expressiveness increases the search state and the annotation
+burden, so a feature needs a concrete graph and counterexample before it earns
+that cost.
+
+### Bounded scope cardinality
+
+The current `unbounded` flag distinguishes one binding from an unlimited
+source. Real tools often expose a finite collection, such as at most ten cases
+or one refund per transaction. A reviewed `max_bindings` bound is the first
+candidate extension because it sharpens the existing scope model without
+turning the manifest into a full application specification.
+
+Per-customer or relational limits come later. They require resource identity
+and relationships, not another integer placed beside the current type count.
+
+### Resource relationships
+
+Scope counts deliberately forget which customer owns a case or whether two
+bindings refer to the same object. If real graphs show that this creates false
+or missed paths, add a small reviewed relation vocabulary and preserve binding
+provenance through tool transitions. Do not jump directly to arbitrary
+preconditions and postconditions.
+
+### Non-monetary effect budgets
+
+Some authority limits count irreversible actions rather than currency, such as
+accounts closed, credentials rotated, or external messages sent. Generalise
+the current cumulative-value mechanism only when those limits share a clear,
+reviewable accumulation rule. Confidentiality and data flow remain a separate
+model rather than being disguised as a numeric budget.
+
 ### Data-flow reachability
 
 Add reviewed source, transform, and sink labels so the analyser can detect a

{agentmandate-0.3.0 → agentmandate-0.3.2}/agentmandate/__init__.py

@@ -13,7 +13,7 @@ against the declaration, so it is usable without another tool alongside it.
 
 from __future__ import annotations
 
-__version__ = "0.3.0"
+__version__ = "0.3.2"
 
 from .diff import Change, Delta, compare
 from .lint import Finding, check

{agentmandate-0.3.0 → agentmandate-0.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentmandate"
-version = "0.3.0"
+version = "0.3.2"
 description = "Compound-path and cross-release analysis of what an AI agent is permitted to do"
 readme = "README.md"
 license = "Apache-2.0"