Wrong verb
A read-only task that resolves to a write or a transfer. The entitlement may permit both; the declared intent authorized only the read, so the write is a deviation and is denied or held.
MCP firewall capability
Intent Enforcement
Same identity, same entitlement, same credential, different intent. An authenticated agent can be steered mid-session into doing something the user never asked for, and identity and network controls all still say allow. Intent Enforcement is the core gate: its Semantic Action Resolver works out what an attempted tool call actually does, the verb, the target, and the scale, and compares that to what the user authorized. A call that matches proceeds; a call that deviates is denied or held. The block decision is deterministic, with no LLM in the path.
Resolve the action, then compare it to intent
The gate holds what the user declared on one side and resolves what the attempted call actually does on the other. The resolved action is expressed as a verb, a target, and a scale. If the two agree, the call is allowed; if they deviate, the call is denied or held.
User-declared intentThe task the user authorized this session, the reference against which every attempted action is judged.
Resolved action · verb · target · scaleThe Semantic Action Resolver works out what the attempted tool call actually does, not what it claims to do.
Compare → allow · deny · holdA match proceeds; a deviation is denied outright or held for review, deny-by-default.
Deterministic decisionThe block decision runs in native code with no LLM in the path, so there is no second model to prompt-inject and no non-deterministic guess gating a production call.
Semantic Action Resolver
From attempted call to decision
The resolver decomposes an attempted call into its meaning and measures it against the declared task. Deterministic checks are sub-millisecond; policy evaluation is single-digit-ms.
Take the declared intent
The task the user authorized this session is the reference. What the agent is entitled to do is separate from what it was asked to do, this gate enforces the second.
INTENTResolve the verb
What does the attempted call actually do, read, write, transfer, delete? The resolver reads the action from the call itself, not from a label the agent supplies.
VERBResolve the target
Which resource does the call reach? A call that drifts from the authorized target, a different account, a different dataset, is a deviation.
TARGETResolve the scale
How much does the call touch, one record or thousands? A single approved action escalated across a whole table is off-purpose even when each row is individually permitted.
SCALECompare and decide
If verb, target, and scale match the declared intent the call is allowed; deviation is denied outright or held for review.
ALLOW · DENY · HOLDWhat deviation looks like
The gate exists because authorization is not the same as purpose. These are the shapes of off-purpose action it is built to catch, even when identity and entitlement all say allow.
Wrong target
A call that drifts to a different account, dataset, or resource than the one the task named. The credential still works, but the target is not what the user asked for.
Wrong scale
A single approved action escalated across thousands of records. Each row may be individually permitted, but the cumulative operation is far outside what was intended.
What Intent Enforcement actually does
Stated plainly, without overclaiming. The block decision is deterministic; the parts that use a model or are on the roadmap are marked as such.
Deterministic block decision
The allow, deny, or hold decision is deterministic, there is no LLM in the block decision. This is not a claim of zero LLM anywhere: the standalone intent extractor is a separate service that may use an async model to structure free-form intent, but it never gates the hard block.
Verb, target, scale
The resolver expresses an attempted call as a verb, a target, and a scale, and compares each against the declared intent. Deviation on any of the three is denied or held, deny-by-default.
Sub-millisecond, then policy
The deterministic checks are sub-millisecond; policy evaluation is single-digit-ms. Enforcement sits on the tool-call path, so an off-purpose call is refused before it reaches the tool server.
Multi-turn correlation is roadmap
Causal multi-turn correlation, tracking a read in one turn against an egress several turns later, is on the roadmap, not shipping. Following the golden rule, policy goes down and telemetry goes up, but customer payloads never leave the local boundary.
Related capabilities
Deciding whether a call should fire at all is the core gate of the MCP firewall. It composes with the controls that clean what the model reads, bound how much an agent may do, and prove what happened.