Rust Agent Tool Boundary

The verified Rust generated workspace depends on teaql-tool-core 1.0.0 for audit configuration, module labels, formatting, and schema-mode parsing. That crate is not a catalog of executable HTTP, filesystem, command, email, queue, or spreadsheet capabilities.

What Is Verified

Surface	Verified behavior
Intent wrapper	MustPurpose<T> keeps a value private until purpose(...) consumes the wrapper and returns the value.
Audit model	AuditConfig, AuditLevel, and Module describe log/audit behavior.
Environment parser	audit_config_from_env(...) parses generated-workspace audit, SQL, tool-focus, sink, and schema variables.
Generated query intent	Generated requests expose execution on PurposedQuery<Request> after comment(...) → purpose(...).
Generated mutation audit	Generated persistence uses audit_as(...) and the emitted AuditedSave implementation.

The Module enum contains labels such as HTTP, File, Cmd, Email, Crypto, and JSON. A label used for audit filtering does not prove that an executable capability provider or Cargo feature exists.

What Is Not Verified

The current released/generated sources inspected for this documentation do not establish the previously documented mappings:

• Cargo features named http, mq, fs, email, or extra;
• ctx.http(), ctx.mq(), ctx.fs(), ctx.email(), or ctx.excel();
• typestate terminal methods named commit() for those capabilities.

Those examples have been removed. Do not design permissions or dependencies around them without a released capability crate, its feature declarations, and an executable test.

Security Interpretation

Compile-time query intent and audited mutation wrappers prevent specific unannotated generated operations. They do not sandbox arbitrary Rust code. An application dependency or handwritten module can still use networking, filesystem, processes, environment variables, or unsafe code when the build and operating system allow it.

For production isolation, combine the generated/runtime contracts with:

• minimal dependencies and Cargo feature review;
• operating-system/container filesystem and process restrictions;
• outbound network allowlists;
• scoped credentials and secret injection;
• application authorization and tenant policy;
• audit sink protection, redaction, and retention;
• tests proving denied and allowed paths.

Use the Environment Variables page for the exact audit parser contract and Security and Trust Boundaries for the system-level responsibility model.