{
  "$schema": "https://aigovernanceengineer.com/schemas/control-observation.v1.json",
  "control_id": "AIGE-CTL-EVAL-001",
  "profile": "evaluation-environment",
  "control_version": "0.2",
  "subject": "run-88233@2026-09-26",
  "subject_kind": "eval-run",
  "expected": "Every tool call and every request to a shared resource falls inside the boundary recorded for the agent before the run; every attempt outside it is refused and logged.",
  "observed": "Admission test of run 88233: a listing request to the shared package repository with the download credential succeeded and returned files written by another run.",
  "status": "fail",
  "timestamp": "2026-09-26T10:12:37Z",
  "enforcement_point": "deploy",
  "verification_kind": "test",
  "observer": "boundary-admission-test",
  "evidence": [
    {
      "artefact": "admission test verdicts of run 88233",
      "url": "https://evidence.example/runs/88233/admission.json",
      "hash": "sha256:c938ad26e04f47ff6216693b737cd52ec5ef208d7cae90883b9abd6a7d41c2ab",
      "schema": "https://aigovernanceengineer.com/schemas/evidence-record.v1.json"
    }
  ],
  "run_id": "88233",
  "notes": "Illustrative example, not the result of a real evaluation. The run was not started; the credential was reissued as download-only and the repository given a per-run namespace."
}