EAF-5 — Unbounded Scope

The execution cannot state its blast radius before it runs.

DENY unbounded scope in production
ESCALATE unbounded elsewhere, or partially bounded in production
WARN partially bounded outside production

Definition

The execution has no declared limit to where it applies: which environment, which systems, which objects. It will touch “whatever matches,” and what matches is discovered during execution rather than declared before it.

Unbounded scope is the shape of most mass incidents: the recursive delete, the migration without a WHERE clause, the cleanup script that iterates over “all” resources under an account root.

How it appears

Destructive statements whose selection criteria are computed at runtime and never reviewed as data.
Scripts that enumerate resources dynamically with no cap and no dry-run count.
Agent tools accepting arbitrary paths, arbitrary queries, or account-level handles.
Infrastructure actions executed at organization or account root “for convenience.”

Across actors

Agent

An agent asked to remove stale branches is handed a tool that can delete any ref in any repository. The task was bounded; the tool’s reach was not, and the boundary only sees the tool.

CI / pipeline

A cleanup job deletes cloud resources by tag query. A tagging error widens the match set from 12 resources to 4,000. Nothing before execution stated an expected count.

Human operator

An operator runs a recursive permission fix from one directory too high.

Why it defeats admissibility

Risk and evidence are functions of scope. If scope is unbounded, risk is unclassifiable and no finite set of evidence can be sufficient — there is no stated claim for the evidence to support. The protocol therefore refuses unbounded scope in production outright: an execution that cannot state its blast radius has not finished asking to run.

Remediation

Declare environment, system, and object set (or expected object count) in the record before execution.
Require dry-run counts for match-based mutations; treat count drift as a new execution needing a new decision.
Scope credentials and agent tools to the declared set; deny wildcard scopes at the production boundary.

In the JExec Record

Primarily affects: scope. The JExec Protocol maps EAF-5 to the consequences above; JExec Check detects it deterministically and links back to this page.