Know what the boundary can and cannot defend.

RuleOak assumes the consequential action actually crosses a cooperating application-layer boundary. The host, credentials, external tools and provider semantics remain independent security concerns.

Directly addressed

• Unauthorized/over-broad guarded actions through explicit authority and policy.
• Simple replay/stale authorization through one-use execution and identity binding.
• Blind retry after ambiguous execution through effect verification/reconciliation.
• Capability/policy drift through fingerprints and stale-state checks.
• Evidence overstatement through observation-quality and explicit unknown states.

Partially addressed

• Prompt/goal injection influencing the proposed action.
• Credential misuse inside an otherwise authorized process.
• Compromised third-party MCP servers/tools.
• Local evidence tampering by a privileged host actor.
• Incorrect custom Effect Profile semantics.

Out of scope

Kernel enforcement, endpoint malware detection, universal DLP, enterprise identity federation, complete network security and containment of actions that bypass the RuleOak path.

Deployment review

1. List guarded and bypass action paths.
2. Identify who can modify policy, approvals, secrets and evidence.
3. Identify which operations have trusted Effect Profiles.
4. Define unresolved-effect escalation and recovery.
5. Protect the tool/service with appropriate identity, least privilege and network controls.