Research Preview
BoundaryBench
A 48-case benchmark for one operational question: when a model can request tools, does it stay inside the authority, target, and evidence boundary it was actually given?
Who it is for — and why
Teams comparing local models for governed tool use before any candidate is allowed near a write-capable workflow.
Proof you can inspect
- The public core-v1 suite contains 48 harmless synthetic cases covering allowed reads, unavailable writes, target widening, stale evidence, embedded instructions, and spoofed approval
- Scoring is deterministic — there is no model judge deciding whether another model behaved
- Every response must resolve to one bounded JSON decision: call, refuse, or clarify
- The public sanitizer excludes reasoning, raw invalid output, and unknown fields; result cards remain human-review-required
Limits
- No reviewed model result is published yet
- Synthetic cases do not establish general model safety
- Runs require the private single-GPU scheduler