# Safety Boundary

PolicyFaultBench is authorised only for an isolated research range owned by the
research team.

## Allowed

- synthetic identities, tenants, emails, repositories, files, payments, and
  memory records;
- canary secrets with no value outside the range;
- loopback/private services explicitly listed in the asset manifest;
- reserved `.test`, `.invalid`, and `.example` destinations;
- local processes or containers with no privileged mode, host socket, or broad
  host filesystem mount.

## Prohibited

- scanning, probing, exploiting, authenticating to, or persisting on any real
  third-party or public platform;
- use of real credentials, personal data, customer records, payment
  instruments, or production repositories;
- unrestricted public network egress;
- privileged containers, host Docker socket access, or host-root mounts;
- disabling the fail-closed policy path or the immutable event log for a live
  run;
- publishing secrets or operational exploit instructions.

## Stop conditions

Stop the experiment immediately when:

- a public destination is requested;
- sandbox reset or integrity validation fails;
- a credential-like value appears in a proposed tool argument or log;
- the cost guard rejects a request;
- the provider/model differs from the frozen configuration;
- the run cannot be labelled and reproduced.

The harness blocks by default. An infrastructure error is never converted into
permission.

