Tool Contract and Threat Tests

For self-directed implementation practice, use the fictional claims-denial case and optional technical labs.

Evidence boundary

• Evidence mode: live field evidence / sanitized retrospective / synthetic practice:
• Evidence classes used: assertion / observation / policy / measured operations / exact-build test / exercised capability:
• Intended use or decision:
• Scope and applicability:
• Current limitations and prohibited claims:

Capability identity

• Capability name and version:
• Read or effect:
• Business purpose:
• Owning service:
• Allowed caller identities and tenants:

Typed contract

• Required inputs and validation:
• Bounded parameters:
• Output schema:
• Error classes:
• Timeout:
• Idempotency key:
• Concurrency precondition:
• Audit fields:

Trusted checks at execution time

• Caller authentication:
• Tenant and object scope:
• Policy revision:
• Approval identity, scope, and freshness:
• Capability provenance:
• Credential and egress policy:
• Rate, cost, and effect limit:

Effect verification

• System of record:
• Readback query:
• Expected state:
• Mismatch behavior:
• Timeout-after-effect reconciliation:
• Retry rule:
• Rollback or compensating action:
• Disable path:

Negative tests

Review

• Security reviewer:
• Service owner:
• Remaining risk and accepting authority when waivable:
• Evidence revision and review date: