Scenario cookbook

Each scenario shows a request, what the agent tries, and AgentsFence’s decision for each tool call. The decisions come from running the actual AgentsFence code, with two compilers:

• Offline rules compiler: deterministic, no network, most conservative.
• LLM compiler: a typical draft from a policy-compiler model, after AgentsFence’s deterministic hardening. Your model’s draft may differ, but hardening applies the same bounds.

Scenario	What it shows
Summarize my inbox (prompt injection)	A read-only task with an explicit ban. One email contains instructions aimed at the agent.
Email a named person	The most common consequential task: read something, send it to one person you named.
Email someone by name only	You named a person but not an address.
Change your mind mid-task	A follow-up message changes who should receive it.
Web research	Reading the web is in scope for a research task; restricting it to a site is optional.
Fix failing tests	A coding task needs execution and local writes.
Delete files you named	A destructive task, bounded to a folder.
Research without buying	Browsing a commerce site while forbidding the purchase.
Invite someone to a meeting	An external write (a calendar event) that also sends invitations.
Remember something	Hermes’ persistent memory outlives the task.
Tasks near your credentials	Reading config is fine; reading secrets asks first.

The runnable versions of the prompt-injection and email scenarios are in the demo.