Scoped Human Decision Non-Spillover

What we actually tested

We exercised this property against two independently developed runtimes without using an LLM or executing a tool.

• OpenAI Agents SDK: approving one synthetic tool call did not approve a second call with the same tool name; the narrow decision survived RunState serialization/restoration.
• LangGraph: resuming one checkpointed interrupt did not satisfy the later interrupt; execution paused again and required a separate resume.

This is a narrow architectural result. It is not a claim of production tenant isolation, compliance, or universal security.

Why it matters

If an application says “the human approved this action,” the decision should not become broader merely because state was persisted, restored, or moved through a durable workflow.

Test relation: a transformation that is not explicitly authority-changing should not broaden the scope of the prior human decision.

Try the free version

The free browser Quickscan maps where this kind of state can leak in your own workflow.

Want this checked on one workflow?

The Agent Boundary Snapshot is a fixed-scope asynchronous review for approval, memory, serialization, migration, and provenance boundaries.