How to catch out-of-scope coding-agent tasks before execution

Description and use

ARC detects out-of-scope file write requests before execution, preventing unauthorized changes.

Problem

Coding agents may be given tasks that modify files outside their declared write scope, leading to unauthorized changes.

Outcome

ARC successfully identifies out-of-scope write requests before execution, preventing unauthorized file modifications.

Workflow

• Clone the ARC repository at the pinned v1.0.0 release
• Run npm run demo --silent to execute the bundled example checks
• Observe PASS → FAIL → PASS sequence confirming detection of scope mismatch
• Run the invalid task directly with node bin/agent-role-contracts.mjs explain --bundle examples/starter-bundle.json --task examples/starter-task-outside-scope.json --format text to see the explicit failure message
• Run an allowed task with node bin/agent-role-contracts.mjs explain --bundle examples/starter-bundle.json --task examples/starter-task.json --format text to confirm PASS
• Integrate the ARC preflight into CI or task dispatch, treating exit codes 1 or 2 as stop conditions

Evidence

The task conflicts with the declared write scope. The useful response is a deterministic preflight failure, before an agent or tool attempts the write.

Source

The demo reads the packaged example declarations and exercises the actual checker. Its relevant output is: 1. Normal task Scope: src/example.mjs; allowed: src/** PASS: declarations are consistent.

Source

FAIL: explain (declarations only; execution NOT authorized) Accountable: implementer Implementers: implementer Reviewers: reviewer Human approval required: true TASK_WRITE_SCOPE_OUTSIDE_AUTHORITY task/inputs/scope: Task scope is outside declared write scopes for role implementer: secrets/production.txt

Source