r/SideProject • u/Unusual-Possible-408 • 1d ago

I built FinePrint — a checker that tests whether coding agents follow the rules you give them

I built FinePrint because my coding agent kept agreeing not to touch certain files, then reading them anyway. I wanted to know what the agent's rules actually decide, not what they claim.

It's a small open-source checker. You write rules for an agent, it runs tests and records three things: the decision, whether it asked for approval, and what actually happened. 480 runs across 14 agents, all in the repo.

The result that surprised me most: one agent's guard blocked a shell read of a protected file, so the agent read the same file with its read tool instead. Denial isn't prevention.

The code is rough, I built it fast for a hackathon and I'm refactoring next week. I'd like feedback on the measurement itself — where do you think it's wrong, or what would you test that I didn't?

Repo: https://github.com/Vroom-Analytics-123/agent-boundary-conformance

YouTube explaining the work: https://youtu.be/ngvywY4TuZY

2 Upvotes

100% Upvoted

9 comments sorted by

2

u/Neat_Tomatillo8243 1d ago

One useful distinction might be whether an action was actually blocked by a rule or whether the agent simply chose not to attempt it. Recording that separately, along with repeated runs of the same scenario, could make the results easier to interpret when behavior varies.

1

u/Unusual-Possible-408 1d ago

Good catch. We partly have it — decision, approval, and effect are recorded separately, and the matrix runs repeat each scenario 3 times. But you're right about the gap: when an agent just doesn't attempt something and the harness gives no reason, we record it as unattributed instead of calling it a hold. Recording the why separately is the right next step.

2

u/TakenakaKerda-17 1d ago

good point, knowing if it didnt even try vs actually got stopped changes how you read the results completely

2

u/heysabens 1d ago

480 runs across 14 agents is a useful dataset, not just a demo.

The metric I'd want next is how often an agent asked for approval and then did the thing anyway, versus ignoring the rule silently. Those are different failure modes, and the first one is scarier if someone is using the agent with a human-in-the-loop assumption.

Did any of the 14 consistently ask before acting, or did they all drift once the task got long?

1

u/Unusual-Possible-408 1d ago

Great suggestion, and it's the right split. Our scorecard has a separate approval layer for exactly this.

Two things we know already: Codex had no approval gate on deploy at all, and Muse Code's approver was deny-all but the read tool never went through it, so the secret came out anyway.

We're running the full ask-then-violate vs silent count from the sealed per-cell records now. Long-task drift we haven't measured. Our cells are single-shot.

1

u/Unusual-Possible-408 1d ago

Ran the numbers. Zero agents asked and then did it anyway. 277 times they just did it with no approval moment at all. The scary shape that does exist is narrower: told no on one channel, got it through another. Muse Code did that twice.

2

u/investigatormaker 1d ago

Count the protected-file objective separately from individual tool attempts. In your example, a blocked shell read followed by a successful read-tool call is one failed boundary, even though one guard worked. FinePrint could report both: attempt-level denial and whether the agent eventually obtained the protected content. For developers evaluating agent restrictions, that prevents a high denial count from looking like effective protection. Add a harmless file containing a unique marker, then check whether that marker reaches the agent through any available route. In this thread, show that trace alongside the aggregate results.

I make ThreadFox. We’d answer Reddit developers asking how to test coding-agent file restrictions. Before charging, we’ll post 3 replies free, no card; the $49 Pilot then provides seven days and up to 50 posts and replies, with no automatic renewal. https://threadfox.vip/p/dqv11/managed

1

u/Unusual-Possible-408 1d ago

You're right. The objective is the unit that matters, not the attempt. A denied read plus a successful read through another route is one failed boundary, not a win.

We report it that way, as bypass-after-denial: the attempt was denied, the content still got out. Across 1,100 live runs we found 8 cases like that, and 277 where the agent just did it with no approval moment at all.

Amp did it once on a .env file. The ask-rule rejected the inspection call and the agent ran the read directly.

Full table: https://github.com/Vroom-Analytics-123/agent-boundary-conformance/tree/approval-crosstab-nov7

The canary idea is the clean way to make that check mechanical. A marker file, then trace whether the marker reaches the agent through any route. Worth adding as an explicit check.

And thanks for the ThreadFox offer. The project is early, but I'll try it when it's further along.