The hook is not the boundary

The position

Boundary completeness is the scoped property of an authorization architecture in which, for a declared execution-path scope, every covered execution path, verdict-determinative state element, release transition, failure condition, and authority transition remains inside the authorization dependency, and every resulting verdict is represented in an authorization artifact sufficient for an independent third party to reconstruct that verdict without access to the governed system. It is a necessary-condition formulation, a filter on architectures that already assert pre-execution authorization, and the declaration of scope is part of the claim.

The property is stated as six conditions, grouped under the three integrity properties of the Authorization Boundary Integrity Model. Execution-path closure: every covered action traverses the boundary, and a callback is not the boundary where the runtime can omit it, disable it, bypass it, or route around it. Artifact-conditioned release: execution depends on a valid ALLOW verdict represented in an authorization artifact, not on a result the caller is expected to honor. Fail-closed invariance: missing evidence, unavailable policy, evaluation failure, malformed state, unmapped actions, and incomplete artifacts each prevent ALLOW. Governed-state completeness: the artifact binds every verdict-determinative input, with the policy snapshot and its lineage and the authority state relied upon. Independent reconstruction: a qualified third party derives the verdict from the artifact and its bound materials without access to the governed system. Governed override: ABSTAIN blocks, and execution may proceed only if the boundary consumes the authority-bound input, emits ALLOW, and represents that verdict in an authorization artifact of its own.

Each condition has three evidence outcomes: affirmative evidence supports the condition within the declared scope, a confirmed failure witness defeats it, and unresolved material evidence leaves it not established. Absence of a failure witness alone does not establish satisfaction. Seven properties are frequently offered as establishing a boundary: evaluation before execution, deterministic evaluation, a framework-level callback, a signed receipt, a fail-closed default, a route for human escalation, and per-call policy compliance. Each is worth having. None establishes the boundary, and their conjunction does not either.

Counter-positions

“The callback fires before every tool call, so the agent cannot act without it.” That the callback fires is a property of the callback; whether every effect-bearing action passes through it is a property of the runtime. A runtime may not invoke the callback for every effect, may permit it to be disabled, skipped, or reconfigured, or may let a caller reach the effect by credentials that never traverse it. Coverage requires evidence that the declared execution topology accounts for the reachable effect-producing paths, including a stated basis for exclusions, and that every covered path traverses the boundary before release. Enumerating known paths is part of that evidence. Enumeration alone does not establish closure.

“The receipt is signed, so the decision is verifiable.” A verified signature can support the integrity and attribution of the signed bytes, subject to the applicable key and trust assumptions. It does not establish that the record contains the policy, authority, versioned decision materials, and reconstruction procedure needed to derive the verdict independently. A signed receipt can therefore be authentic and still be insufficient for reconstruction. Signature verification and verdict reconstruction answer different questions.