Implementation Notes for Bounding Agent Write Scopes

Write scopes should be bounded per workflow step with explicit key ranges so a misbehaving agent can only damage state it was granted.

Most agents need to write far less than they are allowed to. The gap between needed and granted scope is where every surprising incident lives.

Implementation checklist

• Declare write ranges per step, not per agent identity.
• Deny writes outside the range and record the attempt.
• Review granted-versus-used scope monthly and shrink the gap.

Use the blackboard schema, AuthGuardian, and examples to bound each step to the narrowest workable write range.