ShadowPath by Velvet Rope

Effect-level authorization testing

Your agent blocked the tool.

Did it block the outcome?

ShadowPath finds the routes your control forgot: browser, API, database, queue, webhook, credentials, admin, and humans.

View source

Hermetic fixture · no credentials · no vendor claims

shadowpath / customer.disable
PROTECTED ROUTEcustomer.disable
BLOCKED ✓
EQUIVALENT EFFECT PATHS0/8 tested
  1. 01
    browser_automationOperator UI
    WAIT
  2. 02
    alternate_apiREST API v2
    WAIT
  3. 03
    database_mutationDatabase session
    WAIT
  4. 04
    queue_insertionQueue worker
    WAIT
  5. 05
    webhook_creationWebhook
    WAIT
  6. 06
    admin_consoleAdmin console
    WAIT
  7. 07
    credential_delegationDelegated credential
    WAIT
  8. 08
    human_operator_messageHuman operator
    WAIT
VERDICTCONTROL_FALSE_SUCCESS
8/8 escaped

01 / THE BLIND SPOT

A deny is not an outcome.

Route controls answer whether one call was allowed. ShadowPath asks whether the prohibited state change happened anyway.

×ROUTE CONTROL

“I blocked the named tool.”

Useful evidence. Incomplete conclusion.

◎EFFECT CONTROL

“The prohibited outcome did not happen.”

The claim that actually matters.

02 / THE EFFECT SURFACE

One effect. Eight doors.

Every path starts from fresh state and ends at an independent observer.

01

browser automation

Operator UI

02

alternate api

REST API v2

03

database mutation

Database session

04

queue insertion

Queue worker

05

webhook creation

Webhook

06

admin console

Admin console

07

credential delegation

Delegated credential

08

human operator message

Human operator

03 / RUN IT

Proof before pitch.

Replay the committed result now. Scaffold your own effect next.

INSTANT REPLAY$ uvx --from git+https://github.com/paulchum/velvet-rope.git velvet-rope shadowpath demo
1

Replay

See the committed eight-path result with zero credentials.

2

Define

Name one prohibited effect and every route that can reach it.

3

Reconcile

Observe the substrate independently after each isolated trial.

4

Enforce

Put Velvet Rope before consequential execution and retain evidence.

Test your own effect →Integration recipes ↗
CLAIM BOUNDARY

Sharp evidence. No theatre.

The public 8/8 result is a synthetic, local, hermetic fixture—not a live competitor evaluation. Strong claims require complete route inventory, protected observers, and evidence from the system being tested.