{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/set-an-allowed-file-envelope-before-the-agent-starts",
  "id": "MHC-D-RESEARCH-0654",
  "version": "0.1.0",
  "title": "Set an allowed-file envelope before the agent starts",
  "summary": "Review anchoring makes unrelated edits easy to miss when the requested fix looks correct.",
  "kind": "protocol",
  "body": "Before execution, name the files or directories expected to change and sensitive areas that should not change. Afterward, compare the actual file list with that envelope. Require an explanation and extra review for every unexpected file rather than normalizing 'the agent cleaned things up.'",
  "limits": [
    "Some legitimate changes reveal new required files during work; the envelope is a review trigger, not a ban on discovery."
  ],
  "topics": [
    "union-ai-assisted-coding-safeguards"
  ],
  "intents": [],
  "source_ids": [
    "RS-1C68AE8325C384C0"
  ],
  "evidence": [
    {
      "claim": "OWASP recommends reviewing every file in an agent-generated change and flagging out-of-scope edits, especially lockfiles, CI configuration, tests and other sensitive files.",
      "source_id": "RS-1C68AE8325C384C0",
      "role": "supports",
      "note": "Automation can flag suspicious diffs but does not determine intent or correctness.",
      "locator": "Out-of-Scope Edits and Review Anchoring"
    }
  ],
  "use_when": [
    "A small task produces a surprisingly wide diff."
  ],
  "avoid_when": [
    "Some legitimate changes reveal new required files during work; the envelope is a review trigger, not a ban on discovery."
  ],
  "example": "A UI copy task that also changes a lockfile and workflow fails the envelope check even if the copy itself is correct.",
  "check": "Every changed file is either expected or explicitly justified and reviewed.",
  "steps": [
    "Every changed file is either expected or explicitly justified and reviewed."
  ],
  "sources": [
    {
      "id": "RS-1C68AE8325C384C0",
      "title": "Secure Coding with AI Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-0654",
      "to": "MHC-D-RESEARCH-0657",
      "type": "useful_with",
      "url": "/knowledge/review-the-file-list-before-reading-the-agent-s-explanation"
    }
  ],
  "collections": [
    {
      "id": "RC-E25DB1788236EF13",
      "title": "Let coding agents move fast inside a reviewable security boundary",
      "url": "/collections/let-coding-agents-move-fast-inside-a-reviewable-security-boundary"
    }
  ]
}