Agents got real tool access through MCP — and tool poisoning, rug pulls, and confused-deputy OAuth came with it. Assay sits at the tool-call boundary and does three things, in order.

One golden path: the release-pinned agent journey records the nine driven CLI/MCP steps and their exit/stdout contracts. Its protected-action fixture lives in examples/privileged-action-gate/.

Enforce, prove, stay honest

• Enforce. In enforcement mode, the gate decides tools/call requests routed through it before forwarding, with the precise reason for each allow or deny. Separate controls on supported Linux hosts include cgroup eBPF IPv4/TCP connect filtering (whose hook error path allows connections) and Landlock TCP-connect port allowlisting. assay sandbox --enforce refuses an unavailable backend or conflicting filesystem policy unless --allow-audit-fallback is explicit. --enforce-net requires --enforce; active Landlock network enforcement rejects policies it cannot express as TCP-port allowlists, even with audit…