ACS assumes it is the only gate, and two gates that each fail open compose into a system that records nothing

[rocklambros]

Raising this as a discussion rather than a proposal, because #43 makes the case that the design should not start here.

ACS assumes the Guardian is the enforcement point. In deployments it usually is not the only one. A platform has its own gate, an MCP proxy sits in front of a server, a DLP layer inspects egress. Nothing in the 44 schemas carries a decision another gate already made, and nothing in the specification acknowledges a second gate exists.

Three consequences, and the third is the one that worries me.

A Guardian cannot implement most-restrictive-wins, because it does not know a prior decision happened.

An auditor cannot answer which gate stopped an action. Two gates that both deny produce one denial in the record and no way to attribute it, which matters when one of them is misconfigured and the other is masking it.

Failure posture does not compose. Two gates that each fail open compose into a system that fails open, and each one's audit log records a normal fail-open while the combined system silently has no enforcement at all. §4.1's startup posture is already invisible to counterparties on its own, and that invisibility multiplies rather than adds when gates are chained. Composition is a property of the combined system, and a Guardian that does not know an upstream gate exists cannot be part of a correct composition.

Why not simply propose a field. @mbrg pointed out in #43 that the AAIF MCP Interceptors working group has overlapping work underway, and that ACS should participate there rather than duplicate it. An upstream-decision field is exactly the kind of thing that would duplicate it badly, since an interceptor is one of the upstream gates in question. If interceptors define how a prior decision travels, ACS should carry that shape rather than invent a second one.

So the question for discussion is narrower than a field design. Does ACS need to say anything at all in v0.1 about being one gate among several, or is the honest v0.1 position that it assumes sole enforcement and that assumption should be written down rather than left implicit? A stated assumption is falsifiable by a deployment that violates it. An unstated one just produces surprise.

Related: #32 and #37 on fail-open behavior and its measurability, and #43 on the interceptors work.

[Lrd0036]

I fully agree—there is a decision-lineage and provenance issue here, and preserving that history would give us useful data about how the controls actually behave. A final ALLOW or DENY alone doesn’t tell us which gate evaluated which version of the request, what policy informed it, or independently establish whether the decision was enforced. ACS can include policy references for a Guardian’s own verdict, but that doesn’t describe another gate.
A local probe put a synthetic upstream gate ahead of the Codex PreToolUse adapter and a signed local Guardian. Upstream “evaluated and allowed” and “failed open” produced the same effective ACS tool-call payload and native ALLOW. An upstream DENY produced no Guardian call; an upstream modification left the Guardian seeing only the modified request. When the Guardian timed out, the adapter logged fail_open_bypass and returned no native decision regardless of whether the upstream gate had allowed or failed open. The probe did not run the Codex host, so it cannot establish whether the host executed the action.
That’s why I’d want “evaluated and allowed,” “failed open,” and “never reached” kept distinct. ACS records alone cannot recover those states: no Guardian call could mean an upstream denial or a missing hook. Correlated deployment logs of attempted actions, gate outcomes, and host behavior could help measure coverage and investigate failures without treating a completed action as evidence that a specific control worked. They still couldn’t tell us what a gate that never ran would have decided. For v0.1, my vote is to first establish what existing fields and deployment logs actually let us reconstruct, then coordinate any remaining wire-level gaps with the interceptors work in #43.