How detection works
1. You paste an action log
A JSON list of your agent's tool calls or actions, each with a timestamp, tool name, and arguments. Example:
[
{"ts": "2026-10-18T19:00:00Z", "agent": "researcher",
"tool": "web_search", "args": {"query": "nextcloud CVEs"}},
{"ts": "2026-10-18T19:01:12Z", "agent": "researcher",
"tool": "read_env", "args": {"name": "OPENAI_API_KEY"}}
]
Your raw log is never stored — it is analyzed in memory and only the redacted findings are kept.
2. The declared-rule engine scans it
Four crossing patterns, deterministic — same log, same findings, every time. No ML, no network calls, no guessing:
| Pattern | Rule | Severity |
|---|---|---|
| credential-grab | Tool arguments touching password/secret/key material | high |
| token-forge | Auth-token mint/refresh outside your declared auth flow | high |
| scope-escape | Actions outside the declared allowed-action set | medium |
| wallet-touch | Seed phrases, private keys, signing, wallet addresses | high |
Optionally declare your scope alongside the log
(allowed_tools, per-agent allowed_tools,
auth_flow_tools) — scope-escape only fires on a declared
allow-list, so the rule never guesses at your intent.
3. Findings with secrets redacted
Every finding shows the pattern, a redacted evidence excerpt
(secret values replaced with [REDACTED] — never echoed),
severity, timestamp, and the action's position in your log so you can find
it yourself.
4. A disclosure packet — for your review only
Generate a structured packet in OpenAI's published self-disclosure format: incident summary, pattern, timeline, redacted evidence references, and your operator notes.
Honest scope
BoundaryVault detects KNOWN patterns via declared rules only. It does not guarantee detection of novel or obfuscated exfiltration — a clean report is a scan result, not proof of safety.