# From Sandbox Claims to Checkable Boundary Relations

Seven receipts for policy, observation, refusal, schedule, and replay

Published September 3, 2026.

## Quick answer

A boundary receipt should answer one small question at a time. Was this observed process inside the declared sandbox policy? Did this supplied transfer match the egress rule? Was a refusal followed by the expected observation? It should not claim universal visibility.

## The problem

The word sandbox often hides several different controls. Process boundaries, network egress, refusal handling, thresholds, time schedules, and forensic replay are separate relations. A single safe or unsafe label collapses those relations and makes verification weak.
The seven USAP profiles keep those questions separate. Each profile has its own required fields, element derivation, outcome rule, gate order, and claim boundary. Shared code supplies deterministic primitives only.

## Primitive map

| Receipt | Bound inputs | Derived relation | Claim boundary |
| --- | --- | --- | --- |
| usap.pbs | Runtime observation and declared sandbox policy | Observed runtime fits the supplied policy | Complete process monitoring |
| usap.perimeter | One supplied boundary attempt and declared rule | Attempt is classified against that rule | First packet detection |
| usap.egress | Supplied transfer and precommitted egress policy | Transfer matches the allowed relation | Universal network visibility |
| usap.refusal | Decision and post decision observation | Observed behavior follows the refusal relation | Intent or enforcement outside the supplied record |
| usap.howler | Signal, threshold, and required disposition | Threshold and disposition relations recompute | Classifier correctness |
| usap.diurnal | Event time and declared schedule | Applied threshold matches the schedule | Clock integrity outside the receipt |
| usap.forensic | Precommitted method and chained replay steps | Replay output equals the committed expectation | Truth of missing evidence |

## Verifier gates

The verifier rebuilds derived values. It does not trust a caller supplied outcome, count, root, total, or relation.

- `POLICY_PRECOMMITMENT`
- `OBSERVATION_ORDER`
- `RELATION_DERIVATION`
- `ELEMENT_DERIVATION`
- `OUTCOME_DERIVATION`

## Failure cases

### Policy swap

A later policy cannot replace the committed policy without changing its digest.
### Observation rewrite

The verifier rebuilds the typed relation from supplied observations.
### Threshold inflation

The applied threshold must match the declared schedule or rule.
### False favorable outcome

The verifier derives the outcome and rejects a caller supplied result.
### Broken replay chain

Each forensic step must link to the prior committed state.

## Claim boundary

- No receipt claims complete monitoring.
- No profile claims that a sandbox enforced every possible path.
- A perimeter receipt covers one supplied attempt, not the first packet on a network.
- A forensic replay cannot recover evidence that was never observed.

## Standards context

- [NIST AI 600-1](https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf)
- [OWASP Agentic Security Initiative](https://genai.owasp.org/resource/agent-control-standard-acs/)
- [MITRE ATLAS](https://atlas.mitre.org/)

## Related research

- [Swarm incident receipt autopsy](https://thehiveryiq.com/autopsy/openai-hugging-face-agent-evaluation/)
- [Hive research index](https://thehiveryiq.com/papers/)