Skip to main content

​
Policy 2.3 response controls

Policy 2.3 extends exact Policy 2.2 MCP result inspection with deterministic redaction, operator-hosted scanner evidence, and time-bounded observation. These controls run after an exact covered tools/call completes and before its result reaches the client. They do not change outbound intent authorization.

​
Policy source

Declare Release 2 controls under ## mcp alongside the exact Policy 2.2 tool mappings:
The initial class catalog is prompt_injection, secret, malicious_url, and pii. Unknown classes fail validation. The scanner profile is an opaque operator-configured identifier, never a URL. Endpoints and credentials remain runtime configuration. Confidence is a canonical decimal from 0 through 1 with at most four fractional digits. Observe classes require a canonical UTC RFC 3339 expiry.

​
Decision order

The local enforcement order is BLOCK, then REDACT, then ALLOW.
  • BLOCK returns a stable proxy-generated MCP error without upstream content.
  • REDACT replaces only digest-bound UTF-8 ranges that map back to covered text fields. Spans must be valid and are merged deterministically.
  • ALLOW forwards the original SDK-decoded result once.
  • Observe findings never change the disposition. Content that already triggers block or redaction never enters an observe-only scanner or log.
Required-scanner authentication failure, timeout, crash, malformed output, oversize response, excess findings, invalid offsets, or binding mismatch fails closed. Optional-scanner failure records no-content evidence and deterministic evaluation continues.

​
Scanner adapter boundary

Sigil defines and verifies the scanner protocol. Sigil does not host a scanner, response content, models, or weights, and it does not ship scanner code. Microsoft Presidio is an operator-hosted reference adapter only. The scanner request is bounded and binds protocol version, execution ID, policy hash, profile, content digest and length, content type, deadline, and declared classes. The authenticated response repeats those bindings and adds scanner identity, ruleset version, and bounded findings. Operators own endpoint allowlisting, certificates, rotation, availability, model licensing, and the scanner’s runtime.

​
Privacy boundary

Raw response content stays inside the operator trust boundary. It is processed only in the maintained Sigil MCP Proxy path, Agent Hooks, and an operator-hosted scanner. It never goes to hosted Sigil Sign, logs, metrics, traces, hosted receipts, Notion, or the durable execution ledger. Evidence may contain digests, lengths, classes, rule IDs, scanner identity, timing, disposition, policy binding, and deployment revision. The durable ledger stores execution state and digests, never the response body.

​
Compatibility and rollback

Release 2 consumers accept Policy 2.2 format 1 and Policy 2.3 format 2 without reinterpreting either format. Release 1 consumers reject Policy 2.3 and format 2. A Policy 2.2 Warrant containing any 2.3-only key is invalid. Rollback stops Policy 2.3 issuance before reverting consumers. It rejects new 2.3 activation, keeps signed Policy 2.2 operating, preserves no-content evidence, and alerts. It never treats a Policy 2.3 Warrant as Policy 2.2.

​
Limits

  • Only exact covered MCP tools/call results are inspected.
  • ## tool_calls, client-built-in features, MCP resources, prompts, subscriptions, and unknown methods are not result-inspection surfaces.
  • Binary and mixed text-binary applicable results fail closed. Image, audio, embedded blob, transfer-encoding, and multipart-byte inspection are not claimed.
  • The maximum decoded UTF-8 projection is 16 MiB, nesting depth is 16, findings are capped at 256, scanner responses at 1 MiB, scanner deadlines at 2 seconds, compiled policy lifetime at 5 minutes, and observe windows at 30 days.
  • A blocked post-execution result prevents disclosure but cannot undo the upstream side effect.

​
Authoring capability matrix

This is the generated matrix for the current policy family. It comes from the exact released @sigilcore/warrant-core manifest. A guided surface either preserves a supported control or rejects the import before mutating policy state. Source: @sigilcore/warrant-core@0.4.0, AUTHORING_CAPABILITY_MANIFEST, filtered to 2.3.x (capability schema v1). Legend: A = author, I = import, P = preserve without loss, D = deploy. none means the surface rejects that field before mutating policy state. Regenerate the matrix only from the released package: node scripts/generate-current-policy-capabilities.cjs --write. CI and local verification use --check to detect stale capability claims.