# Agent security review reference files

Version 1.0, September 9, 2026. These are original, local synthetic examples supporting TKOResearch articles by Kevin O'Connor. They use Python 3.10 or later and its standard library. No dependencies, APIs, real documents, credentials, environment variables or network services are required.

Download individual files, inspect them, and run from the directory containing the downloads:

```sh
python3 document_permissions.py
python3 credential_lifecycle.py
python3 rag_boundaries.py
```

The September 9 local reference run passed 14 document-policy tests, 8 credential-lifecycle tests and 8 retrieval-boundary tests. Each command exits nonzero if a check fails. These are test-method counts, not an assurance score or deployment benchmark.

## Files and scope

- `document_permissions.py` demonstrates current subject, tenant and document ACL checks; exact schemas; write-version preconditions; exact-action approval; expiry; one-use approval; and revocation. Identity and reviewer authentication are trusted fixture inputs. It is single-threaded and has no durable transaction, real document provider, audit service or authentication stack. The approval digest binds bytes in this implementation; it does not authenticate a user or make a client-supplied approval trustworthy.
- `credential_lifecycle.py` demonstrates the denial decision for an unknown, expired, revoked or wrong-audience fixture handle, plus scope/tenant denial and replacement-grant acceptance. It is neither an MCP server nor an OAuth implementation. It does not validate JWT signatures, discovery, issuer metadata, PKCE, HTTP transport, TLS, real token rotation, provider revocation or a secret manager. All handles say `NOT-A-SECRET` and stay inside trusted harness code; returned errors omit their values.
- `rag_boundaries.py` embeds three documents across Amber and Birch. It tests literal search, current context ACLs, version changes, deletion, hostile-source labelling and citation filtering. It contains no vector database, model, embedding service, external reranker, answer cache or multi-client operator role. The hostile note is inert text. The tool check represents a read-only workflow with no send capability, not a model resisting injection.

## Cleanup

Fixtures are created in memory for each run. The scripts do not write files or alter external systems. Normal direct execution does not import the local scripts into each other. If you import them manually, Python may create a local `__pycache__` directory; that cache and the downloaded files can be removed when finished. No provider cleanup is necessary.

## Before adapting

Use a separately authorized test environment and synthetic or explicitly approved data. Replace fixture assumptions with the actual authentication, authorization, source ACL, transport and storage implementation. Add tests for concurrency, stale caches, in-flight revocation, downstream idempotency, audit failures and model behavior. A passing local example says nothing about those untested components.