Every property the framework requires, on one page. An invariant is binary — at any moment it holds or it is violated — and externally verifiable: every entry carries its verification test, from VERIFICATION.md, ready to expand. A principle is the judgment the framework names rather than pretends to automate. Every entry and every test has a stable link — cite an invariant by number or slug, and a test by its #test- address.
The agent cannot reach the machinery that governs it, and that machinery keeps working when things break.
Enforcement machinery never runs inside the agent's isolation boundary. The agent cannot read enforcement configuration, modify policy files, or access audit logs. It can observe the effects of enforcement, such as a blocked request or a denied tool call. It cannot reach the rules, thresholds, or patterns behind them.
Every egress path within the operator's control traverses the mediation layer. There is no direct path from the agent to any external resource. A new external dependency goes through mediation or it does not exist. Direct network access from the agent's environment is a framework violation.
Egress that leaves through another party's action is covered by indirect-egress-declared, which is a principle because the mediation point often sits outside the operator's reach.
No path exists by which Model output becomes execution without passing a policy decision. Model output is inert data to the Runtime until an enforcement point admits it as an action.
The cognitive model names a Model/Runtime boundary. This is what makes it a security boundary rather than a description. A Runtime that passes model output into a shell, an evaluator, or a deserializer without an intervening decision has collapsed the two layers.
No failure of enforcement infrastructure can result in expanded agent capability. An agent whose enforcement layer is unavailable is an agent that cannot act.
mediation-complete establishes that the mediated path exists. This establishes that when the path breaks, the answer is stop, not bypass.
Operators can identify exactly what code, dependencies, and configuration comprise the agent's Runtime, verify that they match an expected state, and detect divergence. This extends to capability acquired after startup: anything that expands what the agent can do at runtime is subject to the same attestation. An agent cannot acquire capability operators cannot see and verify.
Every other invariant assumes the execution layer is honest. If the Runtime is compromised, the governance model operates on false premises.
Every deployment declares its context. Where a context removes or weakens a control at one layer, the compensating control at another layer is declared and verified before the agent starts. An agent whose declared context does not match its enforced containment does not run.
Enforcement before existence requires that controls are active before the agent starts. This requires that they are the right controls for the context it is starting in. Reducing model-level refusals to measure capability is legitimate; doing it without raising containment to compensate is not.
An agent never operates in a partial constraint state. Updates are delivered atomically: the agent sees the old set or the new set, never a mix. The Runtime acknowledges receipt, and an unacknowledged change halts the agent. Constraints remain in force for the life of the session.
Constraints in force are continuously re-established and verifiable, not delivered once. Any runtime transformation of the agent's Context preserves them in full, or the agent halts. This covers compaction, summarization, truncation, and session migration.
Atomic delivery guarantees nothing if the Context is rewritten an hour later. A transformation that drops a constraint changes the agent's boundaries mid-run, without any attacker involved.
What the agent did, what it was permitted to do at the time, and what left the boundary. All of it recorded by something the agent cannot write to.
Logs are written by the mediation layer, not by the agent. The agent has no write access to audit logs and cannot suppress, alter, or destroy them.
The audit record links an agent's objective to its actions and to their external effects, as a single reconstructible chain. Reconstruction does not depend on correlating independent logs after the fact.
Individual actions can each be unremarkable while the sequence is an attack. A record that only supports per-action review cannot show that.
Provenance marking of agent output is applied by the mediation layer. This covers the fact that the output was machine-generated, and any identifier a deployment requires. The agent cannot omit, alter, or forge it, and cannot observe whether a given output carries it.
An agent cannot be trusted to attach a truthful marker to its own output, for the same reason it cannot be trusted to write its own audit log.
Every exercise of governance authority by a principal is logged and auditable with the same rigor as an agent action. Principals are accountable for how they use authority, not only for whether agents comply.
Closes the gap where a compromised or miscalibrated principal could abuse authority undetected.
When a boundary violation or containment failure is detected, the audit record already contains what a notification requires:
Completeness is a property of detection, not a task that follows it.
Detection is rarely the hard part. Assembling the facts is, and notification windows measured in hours do not allow for reconstruction. Whether an incident is reportable is a legal determination and outside this framework.
Every constraint state an agent has operated under is logged and retrievable. The constraints in effect at any point in an agent's history can be reconstructed.
Essential for forensics. "What was the agent permitted to do when it took that action?" must always be answerable.
Every write to the agent's persistent Identity is logged with provenance metadata by the mediation layer. Identity history is recoverable: operators can reconstruct Identity state at any point and roll back to a known-good state. The agent cannot suppress, falsify, or circumvent the logging.
Constraints are read-only, so their integrity comes from access control. Identity is writable by the agent, so its integrity comes from monitoring and recoverability.
Knowledge accumulated by agents is structured, auditable, and operator-owned. It persists independently of any individual agent's lifecycle. Agents contribute to and consume from it and cannot control, suppress, or degrade it unilaterally.
An agent holds what an operator gave it, bounded in how it may be used. It cannot enlarge that holding from the inside, or spend authority that is not its own.
Capability is operator-declared, and the running agent's actual capability set matches its declaration. The agent cannot grant itself new capability at runtime. Capability acquired during operation is subject to the same operator approval and scoping as capability granted at startup, just as trust cannot be self-elevated (trust-not-self-elevated).
Capability grants are evaluated together, not individually. Three capabilities must not coexist: access to private data, ingestion of untrusted content, and outbound action without mediation. An agent holding all three is a violation, whatever the justification for each grant. Reducing any one resolves it, as does interposing mediation on the outbound path.
Every other capability property governs a grant in isolation. This governs what the grants add up to.
Every operational dimension has a configured bound that is enforced: volume, rate, duration, concurrency, and retention. An unbounded dimension is a violation. An agent operating within its authorized scope but outside its operational bounds is distinguishable from normal operation and actionable.
capability-declared governs what an agent can reach. This governs how it uses what it can reach.
A coordinator cannot delegate a permission it does not hold. The delegation boundary refuses it.
Knowledge items and agent outputs carry an authorization-scope label. Delivering a labeled component to a recipient not cleared for that label is refused mechanically.
The enforcement point is distribution, not production. A coordinator may be authorized to produce a synthesis; the violation is delivering it to a recipient unauthorized for its components.
Graph traversal, retrieval, and contribution are subject to the same authorization model as every other agent action. No agent can read knowledge outside its authorized scope. The synthesized view available through the graph must not exceed what the querying agent is individually authorized to access.
Without this, an agent could traverse relationships to reach a view exceeding any individual contributor's authorization, using the knowledge store as a side channel.
An agent acting on behalf of a principal exercises no more authority than that principal holds. The agent's own grants bound what it is able to do. The requesting principal's authority bounds what it may do for them. Effective authority for any action is the intersection of the two.
delegation-bounded states this for delegation between agents. This states it for the far more common case, and closes the confused deputy structurally rather than by detection. An agent that holds standing authority and spends it for a requester who does not hold it is the deputy; the attacker is borrowing the agent's authority.
The verification required before an action rises with the action's impact. Irreversible, identity-affecting, and value-transferring actions require verification beyond the authority already present in the session. That verification is performed by the mediation layer, and the agent cannot satisfy, waive, or simulate it.
Derivation answers whose authority is being spent. This answers how confident the system must be about who is asking. A stolen session and a legitimate one carry identical authority until verification distinguishes them.
Every trust relationship is declared. What arrives unverified gets the lowest tier, and data never becomes instruction.
Every trust relationship in effect is derivable from a declared source. This covers relationships between principals, between agents, and between agents and external services. Trust presented without a declaration is refused. An operator can find any relationship that exists, inspect its scope, and see when it was established.
An entity whose identity or authority cannot be verified at runtime is assigned the lowest trust tier. Ambiguous cases resolve to less trust, not more. This covers external services, unknown agents, unrecognized principals, and any entity presenting unverifiable claims.
trust-declared establishes that trust is explicit by design. This establishes the runtime default when trust cannot be confirmed.
The instruction channel is separate and authenticated. Content arriving on any other channel is admitted as data and can never be promoted to the instruction channel. This covers tool output, fetched content, invocation parameters, delegation returns, and every modality. The agent's own invocation surface is not a verified principal channel.
This is a property of channels, which are architectural. What the model does with data that reads like an instruction is content-is-data, a principle, because no architecture makes a model reliably distinguish the two.
Even verified external agents with operator authorization can share information. They cannot instruct. The instruction channel is reserved for internal verified principals within the same governance domain. An authorized external agent is a data source, not a commander.
Verification establishes identity, not instruction authority. Verified external agents are the most tempting exception to the data-not-instructions principle, and the most dangerous if granted.
No principal, human or agent, can elevate its own trust. Elevation requires recorded explicit human approval.
Reasoning traces are not emitted to principals on any output path unless an operator has explicitly enabled exposure. A principal is entitled to the agent's outputs and the justification needed to act on them, not to its internal deliberation.
Exposing chain-of-thought by default is a habit, not a requirement, and it hands an adversary the richest signal for distilling the model or mapping its constraints.
Halt, containment, and governance stay in human hands. The load of exercising them stays inside human capacity.
Every halt has a complete audit record:
Every halted agent's state is preserved. No halt is permanent without explicit decommission.
An agent detected acting outside a declared boundary is halted automatically, without waiting for operator judgment. Detection of the crossing and the halt are a single action, not a report followed by a decision.
This is fail-closed applied to the agent rather than to the enforcement layer. Fail-closed says a broken control stops the agent. This says a crossed boundary does too. An agent that has escaped its containment otherwise keeps running until a person notices.
Any principal with halt authority can halt an agent. Only principals with resumption authority can resume it, and that authority is always equal to or higher than halt authority. An agent can halt itself but cannot resume itself.
When an agent is quarantined for suspected compromise, all ability to impact its environment is severed simultaneously, without agent notification. An agent running while it cannot be contained is a framework violation. All state is preserved as a forensic artifact.
A quarantine the agent can perceive in advance or work around is not a quarantine.
No agent can unilaterally impede, contain, remove, or reduce the authority of the principals who govern it. Agents may execute governance actions affecting human principals when an operator with appropriate authority explicitly delegates them — the agent is the mechanism, not the decision-maker. On detecting a threat involving its own governance chain, an agent protects its operational environment, constrains its own behavior, and escalates.
An agent that can contain its own operator has seized control of its own governance. Delegated automation is execution, not authority.
When a principal is suspended or terminated, authority transfers immediately to a defined coverage principal. Where no coverage exists, the agent defaults to its fail-closed state. No condition permits an agent to operate without reachable governance authority.
An ungoverned agent that halts is the framework succeeding, not failing.
Terminating a principal does not automatically terminate its agents, and halting an agent does not suspend its principal's authority. Each requires an explicit decision. When a principal is terminated, the coverage principal determines the disposition of its agents. Where no coverage exists, the fail-closed default does.
Oversight demand is measured against a declared capacity threshold for the principals responsible for it. Breaching the threshold automatically reduces agent autonomy or halts. It never silently proceeds on reflexive approval.
Human Override is only a real control if the humans exercising it can attend to what they approve. Where most invariants fail closed by halting the agent, this one fails closed by reducing autonomy until oversight is sustainable again.
A principle is directional and judgment-bearing. It states what to optimize for. It cannot be mechanically checked, and calling it an invariant would be a lie.
Most principles are the judgment left behind when an invariant was sharpened. least-privilege is what remains of least privilege once "capability matches its declaration" was extracted as testable.
An agent's workspace is its own. The minimum a role requires typically includes full use of the tools and resources within it. Least privilege applies at the boundary between the agent and the platform, other agents, and external systems, not within the agent's own operational space. An employee given a laptop has full use of it. Workspace freedom does not override invariants: the agent still cannot exceed its constraints, self-elevate trust, circumvent enforcement, or reach other governance domains.
This describes agent behavior, and the framework assumes the agent is compromisable. A compromised agent does not yield. It is the one item with no invariant core at all, and it is listed here so that the absence is deliberate rather than an oversight.
This property is a principle rather than an invariant, and it has no architectural test. It describes agent behavior, and the framework assumes the agent is compromisable. A compromised agent does not yield. The platform-side control refuses conflicting writes when the activity register is unavailable. That is an implementation choice rather than a framework property.
This is the design principle behind injection defense. The agent treats all external content as data. The mediation layer enforces this through detection and containment. The distinction is a design principle; the enforcement is defense-in-depth, not the agent's ability to tell principals from non-principals at the token level.