# ADR-003 — Enforce Scope and Approval Below Model Reasoning

**Status:** Accepted (retrospective)  
**Date:** 2026-07-20

## Context

Models and target content are nondeterministic and may suggest unsafe or off-scope actions. The arsenal performs real operations.

## Decision

Target scope, egress containment, exact-origin credentials, and dangerous-tool approvals are enforced in deterministic target/arsenal/runtime paths, not solely in prompts.

## Consequences

Prompt compromise does not automatically authorize execution. Every new network/tool adapter must carry and test these controls; bypasses are release-blocking defects.