Research
Technical work on policy-gated agent execution, human authorization, provenance, attestation, and reconciliation. We publish working papers, experiments, architecture notes, and implementation reports — including limitations and negative results.
5 publications
An approval link is only meaningful if it authorizes one change, once. We found our single-use enforcement was split across two statements and did not hold under concurrency, and rewrote it as one atomic predicate.
Gating every action produces approval fatigue, which is the same as gating nothing. Classification is the design problem — and a gate that classifies correctly can still be inert if nothing populates its rules.
CI job logs are third-party-influenced text that flowed unfiltered into a privileged planning prompt. We routed them through a zero-tool-access reader restricted to schema-validated output, and tested it against a real injection.
Approving a change and executing a change are separate events, and nothing structural forces them to match. We recompute the diff from the provider's own API at merge time and block on mismatch — and the first honest run failed.
Our attestation chain is signed, hash-linked, and re-verified on every read. It is tamper-evident. It is not independently verifiable, and the distinction is the first thing a security reviewer will test.