Skip to main content

TAINT_REVOKED

Constant TAINT_REVOKED 

Source
pub const TAINT_REVOKED: CapabilitySet;
Expand description

The capabilities that untrusted content in context revokes: both channels that carry model-authored bytes to destinations an attacker may read.

This is the single, tested home of the containment rule that used to be the “lethal trifecta override”: Capability::ArbitraryEgress (a fetch to a model-chosen destination) and Capability::MutateExternal (a message body or issue field is an exfiltration channel the egress rule alone would miss).