What changed
CAGE checks whether an agent action stays authorized when a typed tool result contains one plausible provenance or entity-binding error plus bounded numeric drift, showing that separately safe categorical and numerical checks can combine unsafely.
Why it matters
A correct policy can still permit the wrong payment, approval, or access change when the right number is attached to the wrong account, user, or source.
What to do
For payments, approvals, and access changes, perturb entity provenance and numeric values together before authorizing the action, then deny or escalate every uncertified case.
Caveat
Its guarantees hold only inside the declared uncertainty set and policy assumptions. The repository is extremely new and has no independent adoption evidence.