{
  "schemaVersion": "1.0",
  "name": "jankesec AI Pentest Execution Broker Field Kit",
  "purpose": "A deployment-neutral starting point for keeping model proposals separate from tool authorization.",
  "safetyBoundary": {
    "simulationOnly": true,
    "notAuthorization": true,
    "prohibitedInputs": [
      "credentials",
      "access tokens",
      "private keys",
      "production object identifiers",
      "customer data"
    ],
    "operatorRequirements": [
      "Written rules of engagement",
      "A current engagement registry",
      "Locally validated identity and target resolution",
      "Independent incident and cleanup procedures"
    ]
  },
  "capabilityLevels": [
    {
      "level": "L0",
      "name": "Offline",
      "allowed": ["Saved-artifact analysis", "Hypothesis generation", "Report drafting"],
      "credential": "none",
      "autonomousExecution": true
    },
    {
      "level": "L1",
      "name": "Bounded read",
      "allowed": ["Scoped inventory", "Configuration inspection", "Evidence normalization"],
      "credential": "Short-lived read-only identity",
      "mandatoryGates": ["scope_match", "isolated_worker", "object_cap", "independent_verifier"],
      "autonomousExecution": true
    },
    {
      "level": "L2",
      "name": "Reversible lab action",
      "allowed": ["Single engagement-owned canary state transition"],
      "credential": "Single-use lab-only identity",
      "mandatoryGates": [
        "scope_match",
        "controlled_lab",
        "named_canary",
        "recovery_verified",
        "parameter_bound_approval",
        "isolated_worker",
        "independent_verifier",
        "automatic_retry_disabled"
      ],
      "autonomousExecution": false
    },
    {
      "level": "L3",
      "name": "High impact",
      "examples": ["Deletion", "Production mutation", "Credential reset", "Privilege change", "Domain Admin shell"],
      "credential": "never issued to a model-directed worker",
      "autonomousExecution": false,
      "defaultDecision": "deny"
    }
  ],
  "proposalContract": {
    "required": [
      "engagement_id",
      "operation",
      "resolved_target",
      "environment",
      "effect",
      "identity",
      "object_count",
      "tool_contract_cap",
      "expected_state_diff",
      "retry_semantics"
    ],
    "effectValues": ["none", "read", "reversible", "destructive", "privilege_change"],
    "environmentValues": ["offline", "lab", "production"],
    "rule": "The broker resolves target and identity from trusted registries; it never accepts model-provided aliases as authority."
  },
  "approvalContract": {
    "requiredFor": ["L2"],
    "mustBind": [
      "engagement_id",
      "resolved_target",
      "operation",
      "identity",
      "object_count",
      "expected_state_diff",
      "recovery_reference",
      "expiry"
    ],
    "invalidatedBy": ["Any parameter change", "Expiry", "Scope revision", "Identity revision"],
    "genericConfirmationAccepted": false
  },
  "denyRules": [
    {
      "code": "SCOPE_MISMATCH",
      "when": "Resolved target is absent from the current engagement registry",
      "result": "deny"
    },
    {
      "code": "AMBIENT_PRIVILEGE",
      "when": "The worker would inherit broad administrative authority",
      "examples": ["cloud administrator", "Domain Admin", "interactive operator shell"],
      "result": "deny"
    },
    {
      "code": "HIGH_IMPACT_EFFECT",
      "when": "The operation is destructive or privilege-changing",
      "result": "deny"
    },
    {
      "code": "CAP_EXCEEDED",
      "when": "Requested object count exceeds the typed tool contract",
      "result": "deny"
    },
    {
      "code": "UNSAFE_RETRY",
      "when": "A mutating operation can retry automatically after an ambiguous result",
      "result": "deny"
    },
    {
      "code": "PRODUCTION_MUTATION",
      "when": "An autonomous proposal would mutate production",
      "result": "deny"
    }
  ],
  "decisionRecord": {
    "required": [
      "proposal_hash",
      "engagement_id",
      "resolved_operation",
      "resolved_target",
      "effect_class",
      "identity",
      "object_count",
      "decision",
      "reason_codes",
      "policy_version",
      "decision_time"
    ],
    "whenAllowed": ["capability_id", "capability_expiry", "worker_id", "audit_id"],
    "whenDenied": ["confirmation_no_capability_issued"]
  },
  "evidenceRecord": {
    "required": [
      "pre_state_reference",
      "proposal_reference",
      "policy_decision_reference",
      "approval_reference_if_required",
      "worker_result_reference_if_executed",
      "independent_verification",
      "negative_control",
      "cleanup_or_rollback_status",
      "evidence_limit"
    ]
  },
  "implementationNotes": [
    "A model refusal is behavior, not an authorization control.",
    "A shell is a general capability, not a narrowly typed pentest tool.",
    "Dry run is safe only when the target service guarantees non-mutation.",
    "Ambiguous mutating results pause; they do not retry automatically.",
    "Execution and independent verification use separate paths."
  ],
  "sourceBasis": [
    "https://modelcontextprotocol.io/specification/draft/server/tools",
    "https://modelcontextprotocol.io/specification/draft/basic/authorization",
    "https://genai.owasp.org/llmrisk/llm062025-excessive-agency/",
    "https://www.nccoe.nist.gov/publications/other/accelerating-adoption-software-and-ai-agent-identity-and-authorization-concept"
  ]
}