Description
pkg/intent/policy.go ranks Autonomy and WriteScope via autonomyRank/writeScopeRank maps, with any unmapped string treated as rank 0 (least restrictive) per the doc comments. However, Compile() only applies this rank comparison when merging a second-or-later matching rule (mergePolicy, policy.go:200-224). The first matching rule is seeded directly via accumulated = deepCopyPolicy(rule.Set) (policy.go:126) with no validation at all - so if a PolicyRule.Set.Autonomy value has a typo (e.g. "boundeed" instead of "bounded") and it is the only/first matching rule, the invalid string is carried through to the compiled ExecutionPolicy untouched, with no error or fallback to the safest default.
Currently the practical blast radius is limited since the code comment at policy.go:34-37 states PolicyCompiler is advisory-only and not yet wired into runtime enforcement - but this validation gap should be closed before Authorizer.AuthorizeTool integration ships, since a silently-invalid autonomy/write-scope string would then fail open rather than fail closed.
Expected Impact
Closes a fail-open gap in policy compilation before this becomes a real enforcement path; low effort to add now while the blast radius is still advisory-only.
Suggested Agent
General-purpose / whoever owns pkg/intent (intent-attribution-agent-governance spec).
Estimated Effort
Quick (< 1 hour) - validate rule.Set.Autonomy and rule.Set.WriteScope against the rank maps when seeding accumulated in Compile(), falling back to safestDefaultPolicy() (or erroring) on an unrecognized value.
Data Source
DeepReport Intelligence Briefing 2026-08-13 analysis, discussion #52484 (Typist type analysis), verified directly against pkg/intent/policy.go.
Generated by 🔬 Deep Report · agent · 253.2 AIC · ⌖ 48.7 AIC · ⊞ 11.4K · ◷
Description
pkg/intent/policy.go ranks Autonomy and WriteScope via autonomyRank/writeScopeRank maps, with any unmapped string treated as rank 0 (least restrictive) per the doc comments. However, Compile() only applies this rank comparison when merging a second-or-later matching rule (mergePolicy, policy.go:200-224). The first matching rule is seeded directly via accumulated = deepCopyPolicy(rule.Set) (policy.go:126) with no validation at all - so if a PolicyRule.Set.Autonomy value has a typo (e.g. "boundeed" instead of "bounded") and it is the only/first matching rule, the invalid string is carried through to the compiled ExecutionPolicy untouched, with no error or fallback to the safest default.
Currently the practical blast radius is limited since the code comment at policy.go:34-37 states PolicyCompiler is advisory-only and not yet wired into runtime enforcement - but this validation gap should be closed before Authorizer.AuthorizeTool integration ships, since a silently-invalid autonomy/write-scope string would then fail open rather than fail closed.
Expected Impact
Closes a fail-open gap in policy compilation before this becomes a real enforcement path; low effort to add now while the blast radius is still advisory-only.
Suggested Agent
General-purpose / whoever owns pkg/intent (intent-attribution-agent-governance spec).
Estimated Effort
Quick (< 1 hour) - validate rule.Set.Autonomy and rule.Set.WriteScope against the rank maps when seeding accumulated in Compile(), falling back to safestDefaultPolicy() (or erroring) on an unrecognized value.
Data Source
DeepReport Intelligence Briefing 2026-08-13 analysis, discussion #52484 (Typist type analysis), verified directly against pkg/intent/policy.go.