Skill 1
Writing Denied-Path Matrices
Use when proposed agent tool access needs explicit denied actor, resource, action, target, argument, scope, or data-class cases before capability is granted.
Back to Skill Library
Agent governance workflow library
Negative Authorization Test Review
Turn proposed agent tool access into denied-path tests that prove forbidden tools, targets, arguments, prompt-injected requests, policy failures, and side effects fail before real authority is granted.
This is a complete workflow library with 4 individual skills. Download the full library or pick the specific skill folder your team needs first.
Individual skills in this library
Use one skill at a time, or keep the full workflow together.
Some AI tools expect one skill folder per upload. Download the full library when you want the whole workflow, or download an individual skill when you only need one job done.
Skill 2
Building Fail-Closed Deny Fixtures
Use when denied authorization rows must become deterministic policy, wrapper, sandbox, MCP, gateway, parser, or CI fixtures.
Skill 3
Proving Denied Calls Leave No Effects
Use when a denied tool call needs evidence that no external or persistent state changed despite retries, partial execution, or misleading error text.
Skill 4
Gating Capability Promotion
Use when denied-path results must decide whether an agent capability can move from draft or shadow use into broader tool authority.
Security fit check
Is the public Negative Authorization Test Review library enough, or does this need deeper review?
Use the public library when the workflow is low-risk, the inputs are already sanitized, and a team member can review the output before it reaches a buyer or customer.
Do deeper review when this workflow touches real tools, data sources, role ownership, approval paths, or customer-facing output.
Tool authorizationAI OperationsSecurityPlatform EngineeringTooling OwnerWorkflow Owner
Good deeper-review trigger signals
- The workflow touches customer, prospect, CRM, proposal, security, pricing, or campaign data.
- Different teams disagree on the approved source of truth.
- The AI output could become customer-facing, revenue-impacting, or compliance-sensitive.
- You need reusable eval checks before asking more people to use the workflow.