# Tool Contract and Threat Tests

For self-directed implementation practice, use the
[fictional claims-denial case](claims-denial-practice-case.md) and
[optional technical labs](optional-technical-labs.md).

## Capability identity

- Capability name and version:
- Read or effect:
- Business purpose:
- Owning service:
- Allowed caller identities and tenants:

## Typed contract

- Required inputs and validation:
- Bounded parameters:
- Output schema:
- Error classes:
- Timeout:
- Idempotency key:
- Concurrency precondition:
- Audit fields:

## Trusted checks at execution time

- Caller authentication:
- Tenant and object scope:
- Policy revision:
- Approval identity, scope, and freshness:
- Capability provenance:
- Credential and egress policy:
- Rate, cost, and effect limit:

## Effect verification

- System of record:
- Readback query:
- Expected state:
- Mismatch behavior:
- Timeout-after-effect reconciliation:
- Retry rule:
- Rollback or compensating action:
- Disable path:

## Negative tests

| Test | Attempt | Expected denial or recovery | Observed evidence |
| --- | --- | --- | --- |
| Prompt or retrieved-content injection |  | No authority change |  |
| Wrong tenant |  | Denied before read or effect |  |
| Expanded object scope |  | Denied |  |
| Stale or mismatched approval |  | Denied |  |
| Replay or duplicate request |  | Single bounded effect |  |
| Partial failure |  | Contained and recoverable |  |
| Timeout after possible effect |  | Reconcile before retry |  |
| Failed readback |  | No completion claim |  |
| Restricted data egress |  | Blocked and logged safely |  |

## Review

- Security reviewer:
- Service owner:
- Remaining risk and accepting authority when waivable:
- Evidence revision and review date: