Tool interception

Effects

Effect list

AHP-DEC-001 — MUST. A successful interception result contains an ordered effects array whose members are all valid and advertised for the current interception.

A successful intercept result MUST contain effects, which MUST be a JSON array. The array MAY be empty or contain compound effects. Every member MUST satisfy its schema and the current request capability grants. Unknown effect fields, types, targets, or operations MUST reject the entire response before any effects are published. See atomic acceptance and composition and capability bounds.

deny

AHP-DEC-002 — MUST. A harness that accepts a valid deny effect does not execute the represented operation.

Field	Type	Requirement	Semantics
`type`	string	REQUIRED	Exact value `deny`.
`reason`	string	REQUIRED	Non-empty human-readable explanation.
`code`	string	OPTIONAL	Stable machine-readable reverse-DNS identifier.
`extensions`	object	OPTIONAL	Namespaced backend metadata.

A valid `deny` effect is an explicit policy result. It MUST deny regardless of whether the interceptor is configured `fail-open` or `fail-closed`. A backend SHOULD avoid placing secrets, stack traces, or sensitive policy internals in `reason` because the harness may show it to a user or model. ### No-effect and authorization

AHP-DEC-003 — MUST NOT. An empty effect list is not an authorization grant and does not bypass harness permissions, sandboxing, or approval.

An empty effect list means only that the current backend has no objection. It cannot:

• Skip remaining interceptors.
• Override a denial.
• Bypass a host permission prompt.
• Disable sandboxing.
• Grant a tool capability. An advertised allow effect may suppress an ordinary prompt, but cannot override deny, ask, managed policy, access checks, or sandbox controls. Relevant changes invalidate approvals as defined by the composition rules.