Human decision for this release
HUMAN_REQUIRED
The release evidence is current, but no human has approved this exact release yet.
Release control for AI agents
A human approves the release. The AI gets the release tool.
If the release manager revokes approval or corrects the evidence behind it, that WebMCP capability disappears. The AI cannot approve itself, and stale authority is rejected again at execution time.
Product rule: Capability follows current authority.
3 TOOLSagent starts safe
HUMANapproves one exact release
4 TOOLSrelease capability appears
HUMANcorrects or revokes
3 TOOLSrelease capability disappears
Agent
WebMCP tools available now
Registered by EvidenceBound
- Not registered
Reported by this browser
- Not checked
The release tool must stay absent until a human approval matches the current release evidence.
Release inputs
What the approval is based on
Release manifest
PRESENT
- Revision
- 1
- Artifact
candidate
Security evidence
PASS · CURRENT
- Revision
- 1
- Findings
- 0
Release policy
release-policy-v1
- Hard block
- false
- Rule
- exact evidence approval
Human only
Approve, correct, or revoke the release decision
These controls are deliberately not WebMCP tools. The agent may inspect the release and request approval; it cannot grant, restore, correct, or revoke its own authority.
60-second judge path
Watch the release tool appear — then disappear.
- Agent starts with three safe tools. Ask it to inspect the release. The page reports that human approval is required.
- Agent requests approval. The request becomes pending, but the AI still has no release authority.
- Human approves. Click Approve this exact release. The fourth WebMCP tool,
execute_authorized_release, appears. - Agent executes the controlled action. The app re-checks current authority before recording a tab-local receipt with
externalSideEffect=false. - Human changes the decision. Click Correct security evidence or Revoke approval. The release tool disappears. A stale retained descriptor is also rejected by execution-time revalidation.
Why WebMCP is load-bearing
3 safe tools→human approval→4 tools→human correction→3 tools
EvidenceBound does not merely hide a denial inside a permanently exposed action. Current human authority changes the tool surface the agent can discover. Execution then revalidates that authority so a stale capability cannot succeed after the decision changes.
Human + agent timeline
Visible state transitions
- Controlled release demo initialized.
Execution evidence
Tab-local receipts
- No execution receipt yet.
Receipt fingerprints identify this controlled state. They are not claimed as independently anchored or externally durable audit records.
What is actually demonstrated
The judge path is intentionally narrow: one release manager, one exact release, one consequential WebMCP capability. Internally, EvidenceBound distinguishes AUTHORIZED, HUMAN_REQUIRED, STALE, INVALIDATED, and BLOCKED so changed evidence and changed human decisions fail closed.
This WebMCP integration was added during the challenge over pre-existing EvidenceBound control primitives. It does not claim that human approval, provenance, revocation, invalidation, receipts, or dynamic tools were invented here.