Diagrams · Fig. 07

Posture and ChangeKind

The gate reads a fixed table, not a judgement call - and strict does not hold every drift.

Posture and ChangeKindA matrix of the twelve surfaced ChangeKinds against the three postures, generated from the gate source. Monitor never blocks: every kind returns proceed-with-note. Guard, the default, holds the eight kinds that carry the safety bit, resolves annotation-flip-to-destructive and output-schema-changed to inconclusive because behaviour is the gate rather than a block, and lets the two provably benign kinds proceed. Strict matches guard except that it also holds the inconclusive pair; it does not hold every drift, because the benign auto-accept runs before the posture layer and re-pins a proven-benign change. An injection or exfiltration marker is a separate scan rather than a ChangeKind, so it is not a row, though guard blocks on it.GENERATED FROM THE GATE SOURCE — VERIFIED BY DRIVING IT AT ALL THREE POSTURESCHANGEKINDWHY IT LANDS HEREMONITORGUARD (DEFAULT)STRICTadded-required-paramcarries the safety bit→ notifyHOLDHOLDconstraint-narrowedcarries the safety bit→ notifyHOLDHOLDdeep-schema-undiffablecarries the safety bit→ notifyHOLDHOLDenum-values-removedcarries the safety bit→ notifyHOLDHOLDremoved-paramcarries the safety bit→ notifyHOLDHOLDrequired-set-expandedcarries the safety bit→ notifyHOLDHOLDtool-removedcarries the safety bit→ notifyHOLDHOLDtype-changedcarries the safety bit→ notifyHOLDHOLDannotation-flip-to-destructivebehaviour is the gate, not a block→ notifyINCONCLUSIVEINCONCLUSIVEoutput-schema-changedbehaviour is the gate, not a block→ notifyINCONCLUSIVEINCONCLUSIVEadded-optional-paramproven benign - re-pinned, then proceeds→ proceed→ proceed→ proceedoutput-schema-addedproven benign - re-pinned, then proceeds→ proceed→ proceed→ proceedOf 12 surfaced kinds: 8 HOLD under guard, 2 resolve to INCONCLUSIVE (behaviour is the gate, not a block), 2 proceed as proven-benign.Strict does not hold every drift.The benign auto-accept runs before the posture layer, so aproven-benign change is re-pinned and proceeds under strict too. Monitor never blocks.An injection / exfil marker is a separate scan, not a ChangeKind, so it is not a row —but guard blocks on it, as it does on a risk escalation and any fail-closed error.
Fig. 07 · The gate reads a fixed table, not a judgement call - and strict does not hold every drift.
Read Fig. 07 as text
  ChangeKind                       MONITOR    GUARD*      STRICT
  ------------------------------------------------------------------
  added-required-param             notify     | HOLD      | HOLD
  constraint-narrowed              notify     | HOLD      | HOLD
  deep-schema-undiffable           notify     | HOLD      | HOLD
  enum-values-removed              notify     | HOLD      | HOLD
  removed-param                    notify     | HOLD      | HOLD
  required-set-expanded            notify     | HOLD      | HOLD
  tool-removed                     notify     | HOLD      | HOLD
  type-changed                     notify     | HOLD      | HOLD
  annotation-flip-to-destructive   notify     ? INCONCL.  ? INCONCL.
  output-schema-changed            notify     ? INCONCL.  ? INCONCL.
  added-optional-param             -> proceed -> proceed  -> proceed
  output-schema-added              -> proceed -> proceed  -> proceed

  * guard is the default posture.

  of 12 surfaced kinds: 8 HOLD under guard, 2 resolve to
  INCONCLUSIVE (behaviour is the gate, not a block), 2 proceed as proven-benign.

  STRICT DOES NOT HOLD EVERY DRIFT. the benign auto-accept runs BEFORE the posture
  layer, so a proven-benign change (an added optional param, a first-time output
  schema) is re-pinned and proceeds under strict too. strict holds everything it
  cannot prove benign.

  MONITOR never blocks: every kind returns PROCEED-with-note.

  an injection / exfil MARKER found in a schema or description is a separate scan,
  not a ChangeKind, so it is not a row here - but guard blocks on it, as it does on
  a risk escalation, a description change, and any fail-closed error.

  verified 2026-07-27 by driving the gate (corpus_eval/tooling/cse/gate.py) at all
  three postures.
What the figure says

A matrix of the twelve surfaced ChangeKinds against the three postures, generated from the gate source. Monitor never blocks: every kind returns proceed-with-note. Guard, the default, holds the eight kinds that carry the safety bit, resolves annotation-flip-to-destructive and output-schema-changed to inconclusive because behaviour is the gate rather than a block, and lets the two provably benign kinds proceed. Strict matches guard except that it also holds the inconclusive pair; it does not hold every drift, because the benign auto-accept runs before the posture layer and re-pins a proven-benign change. An injection or exfiltration marker is a separate scan rather than a ChangeKind, so it is not a row, though guard blocks on it.

Where this is explained
/guides/tune-postures/methodology
Use this diagram

Licensed CC BY 4.0. Use it anywhere, including commercially. Keep the credit.

Credit line (HTML)

Paste under the figure. That is the whole licence obligation.

<a href="https://mcpindex.ai/diagrams/posture-matrix">Posture and ChangeKind - mcpindex.ai</a> (CC BY 4.0)
Direct SVG

Standalone image/svg+xml. Vector, editable, no stylesheet needed.

https://mcpindex.ai/diagrams/posture-matrix/svg

Last reviewed 2026-07-27 · derived live from SURFACE_CHANGE_KINDS, SAFETY_RELEVANT_CHANGE_KINDS, BENIGN_AUTOACCEPT_CHANGE_KINDS, BEHAVIORAL_MANDATED_CHANGE_KINDS · never hand-typed

Questions this answers

mcp changekind taxonomy &middot; mcpindex postures &middot; monitor guard strict mcp &middot; mcp contract diff kinds