Pure construction of guardrail error payloads — "guardrail, not straitjacket" (ADR-032).
Every enforcing tool returns the same shape: the BND code + rule that fired, the principle behind it, a suggested fix, and — when the rule is overridable — the audited bypass.
Two classes of denial:
--allow, which is
audited.This namespace is pure: it maps a denial to a BND code and assembles the payload from a catalog entry passed in. The catalog lookup (I/O) lives in boundary.mcp.shell.guardrail.
Pure construction of guardrail error payloads — "guardrail, not
straitjacket" (ADR-032).
Every enforcing tool returns the same shape: the BND code + rule that fired,
the principle behind it, a suggested fix, and — when the rule is overridable
— the audited bypass.
Two classes of denial:
* Security/capability gates (BOU-97): tier exceeded, read-only, allowlist,
disabled. HARD — not bypassable per call; the audited override is
changing the environment/context (e.g. MCP_CAPABILITY_MODE).
* Codegen guardrails (Tier 1, BOU-101): FC/IS and convention violations in
generated code. SOFT — bypassable per call with `--allow`, which is
audited.
This namespace is pure: it maps a denial to a BND code and assembles the
payload from a catalog entry passed in. The catalog lookup (I/O) lives in
boundary.mcp.shell.guardrail.(->jsonrpc-error id payload)Wrap a guardrail payload as a JSON-RPC error response for request id.
Uses the :forbidden application code; the structured payload rides in :data.
Wrap a guardrail `payload` as a JSON-RPC error response for request `id`. Uses the :forbidden application code; the structured payload rides in :data.
(build descriptor catalog-entry)Assemble the full guardrail payload from a descriptor (from from-denial
or a codegen guardrail) and a BND catalog-entry map (or nil if the code is
unknown / the catalog is unavailable).
Payload shape: {:code :rule :principle :fix :overridable? [:reason] [:details] [:override]}
Assemble the full guardrail payload from a `descriptor` (from `from-denial`
or a codegen guardrail) and a BND `catalog-entry` map (or nil if the code is
unknown / the catalog is unavailable).
Payload shape:
{:code :rule :principle :fix :overridable?
[:reason] [:details] [:override]}(from-denial denial)Map a boundary.mcp.core.security/authorize denial to a guardrail
descriptor: {:code :rule :reason :overridable? :context}. No catalog text —
the shell enriches it via the BND catalog.
Map a `boundary.mcp.core.security/authorize` denial to a guardrail
descriptor: {:code :rule :reason :overridable? :context}. No catalog text —
the shell enriches it via the BND catalog.(override-event payload context)Audit event recorded when an overridable guardrail is bypassed. Records the rule that was overridden so the bypass is reconstructable.
Audit event recorded when an overridable guardrail is bypassed. Records the rule that was overridden so the bypass is reconstructable.
Tool-argument key that requests an audited bypass of an overridable guardrail.
Tool-argument key that requests an audited bypass of an overridable guardrail.
(override-requested? arguments)Did the caller request an audited bypass? arguments is the tool-call
arguments map.
Did the caller request an audited bypass? `arguments` is the tool-call arguments map.
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |