Research
Technical work on policy-gated agent execution, human authorization, provenance, attestation, and reconciliation. We publish working papers, experiments, architecture notes, and implementation reports — including limitations and negative results.
4 publications · Clear filters
CI job logs are third-party-influenced text that flowed unfiltered into a privileged planning prompt. We routed them through a zero-tool-access reader restricted to schema-validated output, and tested it against a real injection.
An approval link is only meaningful if it authorizes one change, once. We found our single-use enforcement was split across two statements and did not hold under concurrency, and rewrote it as one atomic predicate.
Approving a change and executing a change are separate events, and nothing structural forces them to match. We recompute the diff from the provider's own API at merge time and block on mismatch — and the first honest run failed.
Our attestation chain is signed, hash-linked, and re-verified on every read. It is tamper-evident. It is not independently verifiable, and the distinction is the first thing a security reviewer will test.