From cded128f92d51255268d1f28cbf5eb11cd2d8683 Mon Sep 17 00:00:00 2001
From: hotragn <hotragn.pettugani_2024@woxsen.edu.in>
Date: Mon, 14 Sep 2026 13:12:23 -0400
Subject: [PATCH] Name the initiator where the fields a rule can use are listed

#526 added `initiator` to the policy context so a rule can ask what started a
run, and left both places that tell an operator which fields exist saying
nothing about it. A field nobody can discover is a field nobody writes a rule
against.

The Boundaries screen's own description and the list in docs/architecture.md now
name it, with the part that is not obvious from the name: `actor.id` on a
scheduled run is the routine's owner, so it cannot tell an unattended run from
somebody typing, and this is the field that can.

Documentation only. No behaviour changes and no rule means anything different.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 app/src/routes/_authed/admin/boundaries.tsx | 10 +++++++---
 docs/architecture.md                        |  5 +++++
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/app/src/routes/_authed/admin/boundaries.tsx b/app/src/routes/_authed/admin/boundaries.tsx
index 8efa69457..e96fe7d91 100644
--- a/app/src/routes/_authed/admin/boundaries.tsx
+++ b/app/src/routes/_authed/admin/boundaries.tsx
@@ -178,9 +178,13 @@ function BoundariesPage() {
             <code>key</code> being pressed, the file being touched, the{" "}
             <code>command</code> being run, and <code>mcp.server</code>,{" "}
             <code>mcp.tool</code> and <code>mcp.effect</code> for a call to
-            somebody else&rsquo;s tools. A rule that cannot be evaluated counts
-            as a match, so a mistyped deny refuses rather than quietly
-            permitting what it was meant to forbid.
+            somebody else&rsquo;s tools. <code>initiator.kind</code> says what
+            started the run &mdash; <code>person</code>, <code>routine</code> or{" "}
+            <code>handoff</code> &mdash; which <code>actor.id</code> cannot,
+            because a scheduled run carries its owner&rsquo;s authority while
+            nobody is watching. A rule that cannot be evaluated counts as a
+            match, so a mistyped deny refuses rather than quietly permitting
+            what it was meant to forbid.
           </>
         }
         title="It may never"
diff --git a/docs/architecture.md b/docs/architecture.md
index e5c78bdf5..1879e3805 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -58,6 +58,11 @@ Policy rules can inspect:
 - `command`
 - `file.path`, `file.name`, `file.extension`
 - `mcp.server`, `mcp.tool`, `mcp.effect`
+- `initiator.kind`, `initiator.id` — what started the run, as distinct from whose
+  authority it carries. `person`, `deployment`, `routine` or `handoff`, with the
+  routine or Bot id where there is one. `actor.id` is the routine's owner on a
+  scheduled run, so this is the only field that can tell an unattended run from
+  somebody typing.
 
 Rules use CEL expressions plus case-insensitive `contains()` and `matches()`.
 Deny rules are evaluated before allow rules. The policy engine fails closed: a