Back to Glossary
PROTO

Execution Boundary

agent containmentscope enforcementVEX execution model

An execution boundary is a formally defined perimeter around an agent's authorized action space — specifying tools, data categories, network destinations, and filesystem paths.

BOUNDARY VIOLATION VECTORS

Boundaries are violated through Prompt Injection, SSRF, Path Traversal, and Permission Drift. Execution boundaries are declared at session initialization and enforced by the deterministic proxy throughout the lifecycle.

PROTOCOL CONTEXT (VEX — EXECUTION BOUNDARY MODEL)

The VEX Protocol declares execution boundaries as structured policy. Boundaries specify allowlists across Tool Scope, Data, Network, and Filesystem. Governed execution validates that actions routed through the governed boundary remain within the authorized boundary.

ProvnAI Mitigation

McpVanguard evaluates MCP tool calls routed through the proxy against active boundary policy before forwarding. Boundary policy is declared at session initialization and enforced deterministically for routed activity.