{
 "classes": [
  "ENFORCED",
  "MONITORED",
  "OBSERVED",
  "PARTIALLY_ENFORCED",
  "BYPASSABLE",
  "UNCONTROLLED",
  "UNKNOWN"
 ],
 "note": "MONITORED is never counted as ENFORCED",
 "paths": [
  {
   "basis": "enforce mode by default since 2026-09-27",
   "class": "ENFORCED",
   "path": "hosted gateway /fabric decisions (cainstudio.online)"
  },
  {
   "basis": "claim C42-MCPGATE-ENFORCES",
   "class": "ENFORCED",
   "path": "MCPGate proxy on the live cluster cain-mr-02 (operator test)"
  },
  {
   "basis": "not established that it gates customer calls",
   "class": "PARTIALLY_ENFORCED",
   "path": "hosted MCPGate on customer tool calls"
  },
  {
   "basis": "E25 -> E8 in-process; not hosted",
   "class": "ENFORCED",
   "path": "E25-E30 library actions inside one process"
  },
  {
   "basis": "default-deny; opt-out is recorded, possible",
   "class": "PARTIALLY_ENFORCED",
   "path": "self-hosted SDK guard / MCP proxy"
  },
  {
   "basis": "live run refused 15/15 escape calls",
   "class": "ENFORCED",
   "path": "agent sandbox (namespaces, cgroups, seccomp)"
  },
  {
   "basis": "not implemented on this host",
   "class": "UNCONTROLLED",
   "path": "kernel eBPF enforcement"
  },
  {
   "basis": "CAIN sees nothing it is not in the path of",
   "class": "UNCONTROLLED",
   "path": "tool calls that do not pass through CAIN"
  },
  {
   "basis": "no real actuator adapter",
   "class": "UNCONTROLLED",
   "path": "physical actuators, robots, vehicles"
  },
  {
   "basis": "none connected",
   "class": "UNKNOWN",
   "path": "third-party agents on the open internet"
  },
  {
   "basis": "observation, not enforcement",
   "class": "MONITORED",
   "path": "hourly cluster health proofs"
  },
  {
   "basis": "reads what the sites serve",
   "class": "OBSERVED",
   "path": "public evidence inventory crawl"
  }
 ]
}