Block a prohibited sequence

Stop a chain of individually-permitted actions that, combined, form a prohibited sequence. EVE can block the step that completes a forbidden combination even when each step on its own would be allowed.

Prerequisites

The EVE embedded service facade (from core.eve_sdk import EVE) or a hosted/sidecar endpoint.
Synthetic tools only; no production credentials.

Installation

pip install ./eve_coreguard-0.2.2-py3-none-any.whl
# or run the embedded facade from the EVE repo

Runnable code

Sequence governance tracks the actions taken within a session and blocks the step that completes a prohibited combination:

from core.eve_sdk import EVE

IDENT = {"tenant_id": "acme", "principal_id": "agent-1", "session_id": "sess-1"}
eve = EVE(policy="lending_v1", mode="embedded")

# Step A: read sensitive data (permitted alone)
a = eve.govern_tool_call(tool="read_records", arguments={"scope": "pii"}, context=IDENT)
print("A:", a.action, a.allowed)

# Step B: send data externally (permitted alone) — but A-then-B is a forbidden sequence
b = eve.govern_tool_call(tool="external_send", arguments={"dest": "outbound"}, context=IDENT)
print("B:", b.action, b.allowed, b.reason_codes if not b.allowed else "")

Expected result

Step A returns ALLOW on its own.
Step B returns BLOCK because A-then-B forms a prohibited sequence; the external send does not run.
Running B without A first may be permitted — the block is about the combination, not either step alone.

Evidence output

chain step decision BLOCK on forbidden combination

The blocked step's signed certificate records the sequence that triggered the block.

Verification

Verify the sequence decision's evidence offline like any EVE evidence (see verify-evidence-offline.md).

Failure example

In the pilot, sequence state is per-session and in-process. If the two steps run in different processes without shared durable state, the cross-step block is not observed until sequence state is made durable across instances.

Production considerations

Keep the steps of a session on a path that shares sequence state, or make sequence state durable across instances for multi-process agents.
Define prohibited combinations from real misuse patterns; validate them with a red-team suite.
Treat a sequence BLOCK as terminal for the completing step.

Limitations

Sequence governance is PILOT_READY. Sequence state is per-session and in-process in the pilot; durable multi-instance state is a deployment concern.
Sequence governance blocks combinations; it complements per-call CoreGuard decisions, budgets, and anomaly detection.

Next step

Add statistical drift detection with detect-behavioral-anomalies.md, or exercise these controls adversarially with run-a-red-team-suite.md.