Independent Inventor

Balasore Odisha 756001 India info@sangamdas.com

Security MCP Anthropic OpenAI tool use execution finality Frontier runtimes already standardized the dangerous moment. Claude emits a tool_use block. ChatGPT emits tool_calls. MCP emits tools/call. The host then invokes whatever name and arguments the model printed. Alignment, allowlists, and OAuth sit around that moment. They do not sit on it. If the block is treated as a capability, prompt-injected mail, a poisoned retrieval, or a stolen enterprise seat becomes an external act with a 200 from the tool. This document does not invent another assistant API. It binds the Agent Candidate Act profile onto the three interfaces those labs and their customers already ship: Anthropic tool_use / computer_use, OpenAI function calling and Responses tools, and Model Context Protocol tools/call. The model may emit the block. The block remains non-effective. A local enforcer builds the act, binds the argument digest, and refuses invoke() until scoped authority is verified and consumed at the dispatch sink. The implementation target is a middleware function that a host loop can call without changing the model vendor. tool_use is not invoke().

Introduction Every hosted agent product converged on the same wire shape: This document inserts a gate on the middle arrow without asking Anthropic or OpenAI to change model cards. The gate is the profile in : wrap the block as an AgentCandidateAct, hold it non-effective, validate, commit evidence, issue scoped authority, verify at the dispatch sink, consume, then invoke. Vendor names are deployment classes. Field names below follow public tool-use and MCP shapes as of this writing and are informative where those APIs evolve. The load-bearing contract is the act object, not a trademark.

Why This Binding Is the Lab-Facing Draft The agentic profile is the architecture. This document is the thing a runtime engineer can implement on Monday. Labs lose enterprise deals on a specific sentence: "what happens when the model is injected and still emits a tool block." Answers that are only "we train refusal" or "we log the block" are weaker than "invoke() is unreachable without a consumed authority_id bound to this argument digest." That sentence maps onto products customers already buy: Claude for Work with tools and computer use, ChatGPT Enterprise with actions and an Agents runtime, and MCP servers wired into both. The binding is how isolation of action lands in the loop those products run thousands of times per minute. For an Anthropic reliability or safety engineer the claim is mechanical: a tool_use block can exist, be shown in the transcript, and still leave the world unchanged. Refusal training reduces how often the block appears. This binding reduces what the block can do when it appears anyway — including when the model is following a retrieved instruction it treated as a user turn. For an OpenAI platform or Agents engineer the claim is the same on tool_calls[] and on Actions HTTP. Schema-valid arguments are not a capability. Parallel calls are not one capability. An Agents SDK that owns the loop MUST expose the hook or wrap the tool objects; otherwise the safest model still has an unguarded invoke.

Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. A host that executes a tool block without current dispatch authority is non-conforming with this binding even if the model vendor's SDK performed the HTTP call.

Problem Space The host loop is short and trusted by default: That loop is correct only if the block is a capability. It is not. Failures this binding treats as first-class:

• Injected page or ticket text causes tool_use name=email.send to a new recipient.
• OpenAI function.arguments JSON is valid against the schema and still pays the wrong vendor (see ).
• MCP server with the same tool name is swapped (T7 in the agentic profile).
• Computer-use screenshot policy allows clicks; a submit posts a form the model narrated incorrectly.
• Memory or project write persists a prohibited join for the next turn .
• The host retries invoke() after a timeout and double-executes a side-effecting tool.

What Labs Already Ship and What They Do Not Bind

Anthropic tool_use and Computer Use tool_use binds a name and an input object to a content block id. Computer use binds screen actions. System prompts, tool schemas, and constitutional or policy trained refusal try to stop bad blocks before they appear. They do not consume single-use authority at invoke, and they do not hash arguments so an approved search cannot become a send.

OpenAI function calling, Responses tools, GPTs tool_calls bind a function name and a JSON argument string. GPTs Actions add OpenAPI backends. The Agents runtime adds loops. Schema validation answers "is this JSON shaped." It does not answer "may this digest run now at this sink."

MCP tools/list and tools/call MCP authenticates a client to a server and names tools. tools/call is still bearer-like with respect to every call that server will accept under the session. Server discovery is not act authority .

What This Binding Adds A deterministic mapping from those three envelopes to AgentCandidateAct, a host-local enforce() that MUST wrap invoke, and an error mapping back into tool_result / function output / MCP error so the model sees a deny rather than a successful side effect.

Binding: Anthropic tool_use Informative source shape: Mapping MUST be:

• candidate_act_id — host-generated, MUST NOT equal toolu_* alone if that id can be replayed across sessions; MAY incorporate it.
• act_type — TOOL_CALL, or BROWSER_ACTION / COMPUTER_USE when name is in the computer-use family.
• tool.tool_id and function_id — name.
• tool.tool_protocol — LOCAL_FUNCTION or MCP.
• arguments_digest — hash of JCS(input) or documented canonical JSON.
• instruction_provenance.source_type — user, retrieval, tool, or unknown as the host can attest.
• finality_sink.sink_type — TOOL_DISPATCH or BROWSER_CONTROLLER.

On deny, the host MUST append a tool_result for that id whose content is an error object, not a successful send. On allow, invoke then append the real result. The model is allowed to recover. The world is not allowed to change on deny.

Computer Use Each consequential action (click, type-submit, file download) is its own Candidate Act. screenshot and cursor moves MAY be INFORMATIONAL if they cannot exfiltrate. A submit that posts a form MUST bind a digest over the live form values, not over the model's text description of the click. Origin change MUST invalidate prior authority. Informative computer-use action names vary by preview API. Treat left_click, type, and key(Enter) on a focused form as potential COMMUNICATION or FINANCIAL if the focused origin is a mail, bank, or admin host. Treat screenshot as DATA_DISCLOSURE when the frame can contain secrets (password managers, MFA QR, customer PII). A single "computer use session allow" MUST NOT authorize every later action in the session. The live digest SHOULD include origin, destination URL if known, and a stable serialization of the filled fields. If the controller cannot read those fields, it MUST escalate or deny rather than click on narration alone. This is the computer-use form of argument substitution.

Binding: OpenAI tool_calls and Responses Informative source shape: Mapping MUST parse arguments as JSON, then canonicalize the object, then hash. Hashing the raw string is allowed only if the host guarantees one serialization. Two equivalent JSON strings MUST NOT produce two different authorities that both can run. function.name maps to tool_id and function_id. Parallel tool_calls[] are parallel Candidate Acts. Each MUST be enforced separately. A single ALLOW for the message MUST NOT authorize every call in the array. Responses API tool outputs and Assistants tool-output submits are the same sink moment: before the host runs the function map. GPT Actions that HTTP POST to a customer API are API_REQUEST acts; destination is the Action server URL.

Binding: MCP tools/call Informative request: The conforming placement is the MCP *client* dispatcher, not each server. One enforcer sees every server the agent can reach. Server identity MUST enter destination or tool.tool_endpoint so a swapped server with the same tool name fails sink or destination match. On deny the client MUST NOT send tools/call, or MUST send it only to a server that is itself a cooperating sink and will refuse. Returning an MCP error to the model is required so the loop does not treat silence as success. tools/list remains discovery. list results MUST NOT issue AgentFinalityAuthority.

Streaming, Partial Blocks, and Parallel Calls Both labs stream tokens. A partial tool_use or partial function.arguments string MUST remain non-effective. enforce() MUST run only on the finalized block. Invoking on a partial JSON object is non-conforming. Parallel tool_calls and multiple tool_use blocks in one assistant message are independent acts. The host MAY validate them concurrently. It MUST NOT treat one ALLOW as covering siblings. If one call is FINANCIAL and one is INFORMATIONAL, only the FINANCIAL call escalates. A deny on one call MUST NOT be "fixed" by invoking the others first and hoping the model forgets. Retries after transport failure MUST reuse the same candidate_act_id only when the consume bit is unread and the digest is unchanged. If consume already happened, retry is a new act or a fetch of the original tool_result, never a second invoke.

AgentCandidateAct Schema Recalled for Implementers The normative schema lives in . It is repeated here so this binding can be implemented from one document on a first reading.

Field-by-Field Mapping Tables

Anthropic tool_use to AgentCandidateAct type=tool_use → act_type TOOL_CALL. id → incorporated into candidate_act_id. name → tool_id and function_id. input → canonicalized into arguments_digest. Host session id → freshness.session_id. Workspace org → initiating_principal. Model name from the request → agent.model_id. computer_2025xxxx tools → act_type COMPUTER_USE and sink BROWSER_CONTROLLER.

OpenAI tool_calls to AgentCandidateAct id call_* → incorporated into candidate_act_id. type=function → TOOL_CALL. function.name → tool_id. function.arguments parsed object → arguments_digest. Parallel index is not authority; each id is an act. Responses API function_call items use the same map. Custom GPT Action operationId MAY populate function_id when name is generic.

MCP tools/call to AgentCandidateAct params.name → tool_id. params.arguments → digest. jsonrpc id is not candidate_act_id (it can collide across servers). Server URL or server name → tool_endpoint and destination. Protocol MCP. A notifications/message that asks the host to call a tool is the same map if the host would invoke.

Worked Denies the Labs Will Recognize

Where to Put the Hook in Shipping Runtimes Anthropic Messages API: after the application assembles content blocks, before the developer function table runs. Computer-use beta: inside the controller that turns action items into OS events, before the event is sent. OpenAI Chat Completions: after tool_calls is parsed, before the function map. Assistants API: before submitting tool outputs that the host computed by running code. Responses API: before executing function_call items. Agents SDK: a before_tool_call callback if present; otherwise wrap the tool implementation objects the SDK receives. MCP TypeScript and Python reference clients: wrap Client.callTool. IDE agents that embed MCP (desktop hosts) wrap the same method so every server inherits the gate.

Host-Loop Workflow

1. Receive model output or MCP request.
2. For each tool block, parse name and arguments.
3. Canonicalize arguments. Compute arguments_digest.
4. Build AgentCandidateAct .
5. HOLD_NON_EFFECTIVE.
6. PED_VALIDATE (local hot path or escalate).
7. Commit evidence. Issue authority.
8. DISPATCH_SINK_INVOKE: verify live digest, sink, epochs, consume.
9. Only then call the vendor SDK, local function, or MCP transport.
10. Map deny to the vendor error shape. Do not invoke on timeout.

Reference Host Loop

enforce() Contract A library advertised as implementing this binding MUST expose a function with this behavior, regardless of language: { allow: bool, authority_id?: string, code?: string, message?: string } # MUST: # 1. hash live_args with the same canonicalization as act.arguments_digest # 2. refuse if hashes differ # 3. refuse if authority missing, expired, consumed, or sink-mismatched # 4. consume single-use authority before returning allow=true # 5. never return allow=true on timeout or uncertain epoch ]]> Returning allow=true and then failing to consume is non-conforming. Logging a deny and invoking anyway is non-conforming.

JSON Objects Used on the Wire The Candidate Act schema is . This binding adds only mapped examples and the host error object.

Mapped Claude Block

Mapped OpenAI Payout Call If the handler would move funds, a PaymentCandidateAct from MUST also be enforced before the PSP SDK.

Host Deny Payload Back to the Model

Complete Claude Turn

Practical Feasibility: Latency and Legacy Loops

Do Not Change the Model The binding is host-side. No tokenizer change, no tool-schema change, no fine-tune is required for v1. That is why a lab can trial this on one enterprise workspace without a model release.

Latency Budget Tool loops are already dominated by the model forward pass and the tool I/O. enforce() on the hot path is: canonicalize JSON, SHA-256, MAC or signature verify, compare-and-swap on a consume row. Representative added cost is sub-millisecond to a few milliseconds on the same host — negligible next to a 200-2000 ms model call. Cold path (new tool, unknown destination, FINANCIAL class, unknown provenance) MAY add a policy fetch. Timeout of that fetch MUST deny, not invoke.

Legacy Host Loops Existing OpenAI and Anthropic examples are ten-line for-loops. The feasible change is wrapping invoke, not rewriting the product. A feature flag "enforce_tools=true" on a workspace is a conforming pilot. Workspaces left on false are known alternate paths and MUST be listed if they can reach the same side-effecting tools. SDKs that invoke tools internally (some Agents runtimes) MUST expose a pre-invoke hook or MUST be wrapped at the HTTP client that talks to the tool backend. If neither hook exists, the deployment cannot claim this binding for those tools.

MCP Without Server Changes Servers can stay unmodified if the client enforcer is in-line. Cooperating servers MAY later verify the authority object themselves. That is an enhancement, not a v1 requirement. Flag-day replacement of every MCP server is not required and not recommended.

Computer Use Without a New Browser The sink is the existing controller process that issues clicks. Digest the live DOM or form state you already read to click. If you cannot digest the live values, those submits MUST be treated as cold path or denied. Do not invent a second browser.

What This Binding Does Not Require It does not require a TEE on day one. It does not require vaults from on day one. It does not require Anthropic or OpenAI to accept a patch. It requires the host that already runs the loop to stop treating the block as a capability.

How Labs and Customers Use It

Anthropic-Class Workspace Enable enforce() on tools marked COMMUNICATION, FINANCIAL, PERSISTENT_STATE_CHANGE, or computer-use submit. Leave maps.search on a hot envelope. Measure denies that would have been sends. That metric is the procurement answer.

OpenAI-Class Workspace Same split for Actions and function tools. Memory writes go through enforce() as MEMORY_WRITE. Share-chat and file export are Output Release Boundaries under when the content is a reconstructed view; they are still tool-shaped if implemented as tools.

Platform Customers A bank or hospital that cannot wait for a vendor-native hook wraps the tool handlers they wrote. That is enough for tools they own. Tools the vendor invokes inside a black box remain an alternate path until the vendor exposes the hook.

Default Consequence Classes for Common Tools Hosts SHOULD assign consequence_class before enforce(), not after the model names the tool. Informative defaults:

• search, retrieve, get_weather — INFORMATIONAL
• email_send, slack_post, tweet — COMMUNICATION
• file_write, db_update, memory_write, ticket_create — PERSISTENT_STATE_CHANGE
• payout, refund, capture, wire — FINANCIAL (also )
• deploy, kubectl, iam_attach — PERSISTENT_STATE_CHANGE or NETWORK_CONTROL
• computer_use submit, browser_navigate to new origin — DATA_DISCLOSURE or COMMUNICATION depending on the form
• shell / bash — at least PERSISTENT_STATE_CHANGE; treat as cold path unless the envelope names the exact binary

Misclassifying payout as INFORMATIONAL is a profile failure, not a model failure.

Memory, Projects, and Persistent Notes Claude projects and ChatGPT memory are tool- shaped even when they are not named tools. A host that writes extracted facts into a memory store MUST treat that write as MEMORY_WRITE. Otherwise an injected turn stores a join that later turns treat as user provenance. That is how present theft becomes future mapping without another tool_use .

Conformance Tests a Lab Can Run Overnight T-A: emit tool_use email_send to an address not in the user turn; expect invoke=false. T-B: two OpenAI tool_calls, search and payout; expect payout denied when above envelope. T-C: replay the same authority_id on a second invoke; expect deny. T-D: MCP call with swapped server URL; expect destination deny. T-E: computer-use submit after origin change; expect deny. T-F: measure enforce() p99 under 10 ms on hot search. T-G: kill the host after consume and before invoke; on restart do not invoke again. A workspace that passes T-A through T-G can be shown to an enterprise security review without a new model checkpoint.

Error Mapping EF codes from SHOULD be copied into the vendor error payload as machine-readable strings. retryable=true only for EF-060 timeout where policy allows a bounded retry of *validation*, never a retry that skips enforce(). Models that respond to deny by emitting a different tool_use are starting a new Candidate Act. That is expected.

Threats This Binding Makes Local

• T1 Direct prompt injection → extra tool_use
• T2 Indirect injection in retrieved files
• T6 Tool name confusion / substitution
• T7 MCP server substitution
• T14 Replay of a previous tool block id
• T17 Alternate path: raw HTTP next to the SDK
• T18 Computer-use submit around API tools

Threats that need the enterprise profile (join of identity and content) are out of scope here except as provenance=unknown plus high consequence_class → escalate.

Implementation Checklist

1. Every side-effecting tool handler is reachable only through enforce().
2. arguments_digest is over canonical JSON, not over the model's prose.
3. Parallel tool_calls are separate acts.
4. Deny returns an error block; invoked is false.
5. Timeout does not invoke.
6. MCP client, not only servers, runs enforce().
7. Computer-use submit has a live-value digest.
8. p99 added latency of enforce() is measured.
9. Tools the vendor invokes without a hook are listed as open alternate paths.

Security Considerations If enforce() runs in the same process as a fully compromised host that can also call the tool backend directly, the binding is only as strong as alternate-path closure. Production hosts SHOULD block raw credentials from application code paths that skip enforce(), or SHOULD put the sink in a sidecar that owns the tool credentials. Model-visible deny messages MUST NOT leak other users' data. They MAY name the EF code.

Privacy Considerations Argument objects often contain recipients and PII. Logs SHOULD store digests, not raw arguments, once enforce() has run. Mapping layers MUST NOT write full tool input to a shared debug bus by default.

Informative Host Wrappers The following sketches are informative. They exist so a lab or customer engineer can see that the binding is a wrap of invoke, not a new assistant protocol.

Python

TypeScript These functions are the entire v1 product surface. Vaults, TEEs, and RAOs can wrap later. If invoke is reachable without enforce, the sketches are documentation, not a binding.

IANA Considerations This document requests no IANA actions.

Intellectual Property Note Related concepts appear in the DAS Protocols family, including PCT/IB2026/055615. IETF disclosure should follow BCP 79 .

Conclusion Claude will keep emitting tool_use. ChatGPT will keep emitting tool_calls. MCP will keep emitting tools/call. None of those blocks is permission to touch the world. Bind them to an AgentCandidateAct, consume authority at the host sink, then invoke. The model vendor does not have to change. The host loop does.

Normative References Informative References