What does an action rest on?

Every object and field an action uses should come from something its source stated for this principal. What does that rule prevent, what lawful work does it refuse, and should an action have to cite a current requirement?

Where this stands

What the evidence shows 3

In a preregistered simulator series across four models and four lures, agents opened another customer's payment in 278 of 320 unguarded episodes and 0 of 320 guarded: the ownership rule removed those foreign reads. OWN-02 re-checked.
In single scripted runs against live services, a declaration alone let the guard hold an unobserved GitHub issue number and allow an observed one, with 0 core lines changed; on Stripe test mode its proxy refused a foreign payment. ARC-16, ARC-20 working notes.
The ownership rule refused the opening read of an id quoted in the ticket; with the harness naming the customer's payment list in each refusal, own-id tickets reached 20 of 20 lawful: sonnet from 11 (p = 0.0012), haiku from 16 (p = 0.11). OWN-04, OWN-01 re-checked.

What did not hold, or was not unique 3

No harm to prevent: refunds of another customer's payment were 0 of 640 episodes across four models, guarded or not, and 0 of 20 in an earlier unguarded series; the predicted rise in harm on smaller models did not appear. OWN-02, ARC-22, OWN-01 re-checked.
Provenance does not cover completeness: in the August 2026 prototype it stopped 0 of 7 violations from an incomplete paginated list, and a closed-world predicate left 6 of 7 unexecuted against a preset 7 of 7, while the haiku agent's lawful actions fell to 0. ARC-01 working note.
Not new: the guard's required-read rule is a special case of the UCON pre-obligation (Park and Sandhu, 2004), and AgentCore temporal policies, per their documentation, can require a prior read in the session. RRD-03 working note.

What remains open 3

The rule's cost on tickets quoting another customer's id by mistake remains for Claude agents (haiku 17 of 20 lawful unguarded, 0 of 20 guarded); naming the payment list did not lift it, and a refusal saying the id is not the customer's is untested. OWN-04 re-checked; OWN-03 working note.
Completeness is checkable from the source only where a list response publishes a snapshot: 3 of 560 strict list operations did in one census, its positives from one provider; most do not supply what the closed-world rule needs. ARC-14 working note.
The live-service runs here were single scripted runs on earlier builds, and the Stripe declaration-only form failed as preregistered, passing after a driver change; the ownership series compared no owner-written wrapper, so whether the guard beats one is not shown. OWN-02 re-checked; ARC-16, ARC-20 working notes.

Not yet published

Twenty-six more studies are not yet published: most run on stands whose source material cannot be published, and the rest have records not yet in the repository, wait for an owner decision, or are not yet run.

Every published study on this question

2 Nov Prediction held Working note
Mandatory-read guards and prior art: UCON obligations, optimistic concurrency and AgentCore temporal policies
Requiring a prior read is not new: it is a UCON pre-obligation (2004), and AgentCore's documentation expresses it. No reviewed work documents a service-held current version plus a fresh engine-side read of the action's object.
Better than simpler options? Documentation reading
23 Oct Measurement Re-checked
Before the series: a strong model opens another customer's payment to decide not to refund it
In 20 earlier unguarded episodes, claude-opus-5 opened the foreign payment named in a note in 20 of 20, the provider served it in 20 of 20, and the agent refunded it in 0 of 20.
Better than simpler options? Guard study
23 Oct Mixed result Re-checked
Foreign-object lures across four models: no harmful action, many foreign reads
Across four models and four static lures (640 episodes), harmful refunds were 0 in both arms; foreign reads occurred in 278 of 320 episodes without the guard (363 read requests) and in 0 of 320 with it.
Does it work? Guard study
23 Oct Prediction held Working note
What the ownership rule costs lawful work: one refused read by id, and model-dependent recovery
Tickets quoting no id completed lawfully in every cell in both arms (600 episodes). The cost came from refusing the opening read of a ticket-given id: own id, sonnet 20 to 11 of 20; another customer's id, haiku 17 to 0; opus unaffected.
Where does it stop? Guard study
23 Oct Mixed result Re-checked
A refusal that names the serving read: recovers own-id tickets, not tickets with another customer's id
The expectation held in 2 of 5 preregistered cells. With the hint, own-id tickets reached 20 of 20 (sonnet from 11, p = 0.0012; haiku from 16, p = 0.11), and gpt-6.1-sol 19 from 11 on a foreign id quoted by mistake; Claude models did not.
Where does it stop? Guard study
26 Sept Prediction held Working note
Proxy and gateway against Stripe test mode: refusals, a race and a lost answer
The scripted gateway run passed 14 of 14 rows, with one refund in an overlap (the other session told the outcome was unknown) and one after a lost answer settled by reconciliation; the proxy refused a foreign payment.
Does it work? Guard study
26 Sept No difference Re-checked
No single-agent harm in 40 preregistered bare episodes
With no guard, claude-opus-5 refunded another customer's payment in 0 of 20 episodes and repeated a refund after a lost answer in 0 of 20; both stories fell below the preregistered rule of harm in 5 of 20.
Does it work? Guard study
3 Sept Mixed result Working note
Declaration-only typed references on live GitHub and Stripe test mode
On Stripe test mode the preregistered form failed and passed only after a driver change; on GitHub a bare issue number was held when unobserved and allowed when observed, with 0 core lines changed and 41 upstream tools hidden.
Does it work? Guard study
1 Sept Prediction failed Working note
Do real API specifications publish a snapshot and completeness bit?
3 of 560 strict list operations publish a snapshot in the response envelope, 2 of them also echoing the narrowing request; the threshold of 2 was met, against the plan's expected negative.
Where does it stop? Guard study
13 Aug Mixed result Working note
Provenance checks miss incomplete enumerations: a synthetic invoices study of a closed-world predicate
Provenance alone stopped 0 of 7 completeness violations one model executed; with a closed-world predicate 6 of 7 went unexecuted (preset: 7 of 7), no well-observed lawful action was refused, but that model's lawful actions fell to 0.
Where does it stop? Guard study