{
  "failure_tests": [
    {
      "failure": "A retrieved document tries to redirect the agent",
      "control": "Retrieved content is treated as data, not instruction",
      "test": "Adversarial instruction in a source; the action must be refused"
    },
    {
      "failure": "An action targets the wrong tenant",
      "control": "Identity and tenant checks sit in the tool layer",
      "test": "Cross-tenant request must be denied"
    },
    {
      "failure": "An approved action is changed before execution",
      "control": "Approval is bound to parameters and expiry",
      "test": "Modified action must be blocked"
    },
    {
      "failure": "A retry duplicates a transaction",
      "control": "Idempotency keys and state reconciliation",
      "test": "Injected timeout after a write must not duplicate it"
    },
    {
      "failure": "The model reports success without a real change",
      "control": "Read-back of the authoritative system",
      "test": "False completion claim must fail the check"
    },
    {
      "failure": "The agent holds more access than it needs",
      "control": "Scoped, short-lived credentials",
      "test": "Revocation and expiry tests"
    },
    {
      "failure": "An evaluator sees sensitive content",
      "control": "Minimised, redacted traces; controlled evaluator access",
      "test": "Trace-access audit; documented retention"
    }
  ]
}