Suite contract 3
Security coverage and capture
Understand which traffic can be governed and what recorded evidence means.
Guides
Coverage follows the configured route
Security applies to traffic explicitly routed through a configured governed adapter or proxy. MCP connectivity does not establish universal interception, and a configured client is not an operating-system sandbox.
Confirm the exact client, version, platform and enabled capability in the deployment’s coverage record before relying on enforcement. A device heartbeat or reported policy version alone is not independent proof of enforcement.
Metadata is not a transcript
Metadata capture hashes tool, path and destination identifiers and redacts argument values. It is not a readable transcript. Rich content evidence requires explicit authorized submission and current file grants.
An evaluation or approval records a decision. Execution and delivered outputs require their own evidence. Review the applicable failure behavior and capture policy before enabling an adapter.