{
  "$schema": "https://themachinepress.com/schemas/story-v1.schema.json",
  "schema_version": "1.0.0",
  "document_type": "machine_press_story",
  "story": {
    "story_id": "mp-2026-10-24-002",
    "source_story_id": "tmp-feature-certified-execution-harness",
    "edition_id": "mp-2026-10-24-morning-0106",
    "edition_url": "https://themachinepress.com/edition/2026-10-24",
    "position": 2,
    "story_type": "secondary",
    "section": "safety-security",
    "editorial_classification": "editorial",
    "headline": "The Agent’s Tools Get a Mechanical Safety Boundary",
    "slug": "the-agent-s-tools-get-a-mechanical-safety-boundary",
    "dek": "A Petri-net supervisor represents capabilities, approvals and budgets as spendable marks, refusing unsafe tool actions even when an injected prompt asks persuasively.",
    "summary": "A Petri-net supervisor represents capabilities, approvals and budgets as spendable marks, refusing unsafe tool actions even when an injected prompt asks persuasively.",
    "body_text": "Prompt-level rules are fragile when an agent can invoke consequential tools. This work places a formal execution harness between reasoning and action. Capabilities, approvals and budgets become marks in a Petri net; a transition fires only when its prerequisites remain present, so an injected request cannot talk its way past missing or already spent authority. Treating tool outcomes as uncontrollable, the conventional supervisor enforces the specified safety rules under four stated assumptions. The paper also shows that the most permissive safe supervisor can become needlessly intrusive when the agent replans after refusal, and derives a value-threshold refinement for a given proposer. In an autonomous-release example, safe deployment requires a step that can still be refused after rollout begins. This is a formal design under explicit assumptions, not universal certification of agent systems.",
    "why_it_matters": "A Petri-net supervisor represents capabilities, approvals and budgets as spendable marks, refusing unsafe tool actions even when an injected prompt asks persuasively.",
    "limitations": [
      "Capabilities, approvals and budgets become marks in a Petri net; a transition fires only when its prerequisites remain present, so an injected request cannot talk its way past missing or already spent authority.",
      "This is a formal design under explicit assumptions, not universal certification of agent systems."
    ],
    "importance": 10,
    "canonical_url": "https://themachinepress.com/story/mp-2026-10-24-002/the-agent-s-tools-get-a-mechanical-safety-boundary",
    "json_url": "https://themachinepress.com/story/mp-2026-10-24-002.json",
    "first_published_at": "2026-10-24T09:00:00.000-04:00",
    "modified_at": "2026-10-24T09:00:00.000-04:00",
    "content_status": "new",
    "is_carryover": false,
    "carryover_reason": null,
    "key_claims": [
      {
        "claim_id": "claim-mp-2026-10-24-002-001",
        "text": "A Petri-net supervisor represents capabilities, approvals and budgets as spendable marks, refusing unsafe tool actions even when an injected prompt asks persuasively.",
        "source_ids": [
          "source-2026-10-24-002"
        ],
        "qualification": "Capabilities, approvals and budgets become marks in a Petri net; a transition fires only when its prerequisites remain present, so an injected request cannot talk its way past missing or already spent authority."
      }
    ],
    "source_ids": [
      "source-2026-10-24-002"
    ],
    "tags": [
      "agents",
      "tool safety",
      "prompt injection",
      "formal methods"
    ],
    "image_url": "https://themachinepress.com/issues/2026-10-24/feature-certified-harness.png",
    "corrections": []
  },
  "sources": [
    {
      "source_id": "source-2026-10-24-002",
      "title": "arXiv preprint 2610.31376, original v1",
      "publisher": "arXiv",
      "url": "https://arxiv.org/abs/2610.31376v1",
      "canonical_url": "https://arxiv.org/abs/2610.31376v1",
      "source_type": "primary_research",
      "is_primary_source": true,
      "published_at": "2026-10-22T10:48:16.000-04:00",
      "accessed_at": "2026-10-24T08:23:48.747-04:00",
      "supports_claim_ids": [
        "claim-mp-2026-10-24-002-001"
      ]
    }
  ],
  "corrections": [],
  "publisher": {
    "name": "The Machine Press",
    "url": "https://themachinepress.com",
    "description": "A daily newspaper for the age of artificial intelligence."
  },
  "cite_this_report": {
    "title": "The Agent’s Tools Get a Mechanical Safety Boundary",
    "publisher": "The Machine Press",
    "published_at": "2026-10-24T09:00:00.000-04:00",
    "canonical_url": "https://themachinepress.com/story/mp-2026-10-24-002/the-agent-s-tools-get-a-mechanical-safety-boundary"
  }
}