{ "schema": "https://miscsubjects.com/schemas/jarticle.json", "status": "published", "slug": "authority-outside-the-model", "title": "Authority outside the model: a prospective control plane for containing agent actions", "kind": "architecture", "summary": "In this build a model does not set its own authority: limits are a token checked outside the model, actions are declared operations the runtime executes, and every use and refusal is recorded by the runtime. This page states what that could contain in development, training-time tool use, evaluation and deployment, what is enforced today, and what full containment would still require.", "tags": [ "architecture", "agents", "ai-safety", "containment", "control-plane", "least-privilege", "macaroons", "compound-tools" ], "facts": { "thesis": "model-independent containment and accountability: authority, execution and evidence held outside the model", "primitives": { "compound_tools": { "bounds": "the action space", "built": "CODE: 11 operations (schema, grep, read, edit, write, check, grammar, deploy, ship, job, result); hash-checked canonical writes; detached tests and deploys; deterministic operations, no model planner", "designed": [ "REST", "SEARCH", "COMPUTER" ], "read_from": "GET /api/tools/CODE, 9 October 2026" }, "unified_dispatch": { "bounds": "the path", "gap": "some device doors are reachable directly with the build key" }, "scoped_tokens": { "bounds": "the authority", "limits": 11, "gap": "no running agent uses one yet" }, "ledger": { "bounds": "the evidence", "gap": "events held in memory are lost if a Worker dies before the write" } }, "enforced_today": [ "every Directory tool call through one runner", "token chain recomputed and compared in constant time on every call", "unknown caveat refused", "refusal recorded before anything is sent (T-0229, 3 October 2026)", "exact-byte recording at the request boundary, SHA-256 deduplicated", "CODE built as a compound tool" ], "required_for_containment": [ "every agent on a scoped token; build key withdrawn from agents", "no path around the runner: raw shell tools and directly reachable device doors excluded", "egress forced through the runner", "task binding on the live task store", "evidence writes awaited", "an adversarial test of the whole boundary" ], "out_of_scope": [ "model weights", "gradient updates", "training computation", "internal reasoning" ] }, "card_fields": [ "thesis", "primitives.scoped_tokens.gap", "required_for_containment" ], "ontology": { "above": [], "below": [ "directory-ledger-pattern", "unified-dispatch-macaroon-atoms", "task-payload-provenance-article" ], "adjacent": [], "nested": [ "unified-dispatch-macaroon-atoms", "directory-ledger-pattern", "task-payload-provenance-article" ], "show_position": false }, "body": [ "## The model does not set its own authority\n\nIn most agent stacks the model holds a credential and a set of instructions, and the instructions are the only limit. The model reads them, so the model is the last thing standing between a bad output and a damaging action. OWASP names the failure: excessive agency, damage done \"in response to unexpected, ambiguous or manipulated outputs from an LLM\", whatever caused them.\n\nThis build moves three things out of the model's hands:\n\n- **What it may do** is a scoped token, checked on every call by code the model cannot see or change.\n- **How an action executes** is a declared operation run by the runtime, through one dispatch path.\n- **What record is kept** is written by the runtime while the work happens, not reported by the model afterwards.\n\nA model can be wrong, manipulated, or working against its operator. None of the three checks asks it. That makes these mechanisms model-independent, and that is their significance: they are candidate primitives for a control plane that contains model actions, during development, during training-time tool use, in evaluation and in deployment. They are not only a better way to call tools.\n\n## Four primitives, one containment job each\n\n| Primitive | What it bounds | Where it is enforced | Today |\n|---|---|---|---|\n| Compound tools | The action space: declared operations with bounded arguments, not arbitrary code | The runtime's contract for each tool | Built and live: CODE, WEB, COMPUTER, RESULT; REST designed, not built |\n| Unified dispatch | The path: every capability call goes through one runner and one check | The tool runner | Every Directory tool; some device doors are still reachable directly with the build key |\n| Scoped tokens | The authority: tools, doors, arguments, paths, uses, time, task, whose credentials | An HMAC-chained token checked on every call | Implemented and live; no running agent uses one yet |\n| Ledger and task provenance | The evidence: every call and every refusal, written by the runtime | An append-only PostgreSQL table and per-token call logs | Recording at the request boundary; a known loss window, stated below |\n\nThe mechanics of each are in the three companion articles: [[directory-ledger-pattern|Directory and Ledger]], [[unified-dispatch-macaroon-atoms|scoped tokens]] and [[task-payload-provenance-article|task provenance]].\n\n## Compound tools are programmatic tool calling in reverse\n\nProgrammatic tool calling lets a model write code that calls tools inside a code execution container. The intelligence goes into generated code, and the sandbox has to hold whatever that code does.\n\nA compound tool inverts this. The runtime holds the logic, and the model holds one tool per domain. The model states a command and its complications: modifiers that shape the call, such as which fields to return, how many bytes, which stored credential, and which retry policy. The runtime compiles the declaration into the real call.\n\nThe coding tool is built this way, and so are WEB (search and read), COMPUTER (browser procedures) and RESULT (read back part of any earlier call); a single REST tool for every HTTP API is designed, not built. Its live contract lists eleven operations (schema, grep, read, edit, write, check, grammar, deploy, ship, job, result), hash-checked canonical writes, detached tests and deploys, and \"deterministic operations; no model planner\". An edit against a stale hash is refused, not applied. The answer is cut to what the model asked for, and the whole result is kept by reference.\n\nFor containment, the inversion is the point:\n\n- **The action space is enumerable.** Every operation and complication is declared, so a scoped token can bound each one with an argument rule.\n- **The failure mode is a refusal.** A wrong declaration is refused by the runtime. It does not become arbitrary code.\n- **Evidence is automatic.** The runtime produces the record, so the model cannot shape it.\n\nGenerated code remains the fallback for genuinely novel logic. That fallback is also where containment is hardest, because the sandbox then has to hold anything.\n\n## What this could contain, phase by phase\n\n- **Development.** A coding agent edits only through hash-checked operations, in allowed paths, for one task, until the task closes.\n- **Training-time tool use.** Each rollout in an agentic environment could run under its own token: which tools, which arguments, which paths, how many uses, until when. Every call and every refusal would be recorded by the runtime, independently of the policy's own transcript. An attempt to exceed authority becomes an observable event with the caveat that stopped it.\n- **Evaluation.** A task's record shows what the agent did, not what it said it did, and refusals measure attempted overreach directly.\n- **Deployment.** Least privilege per job: the minimum access needed for the assigned task. Delegation can only narrow a token, never widen it.\n\nWhat it does not control: model weights, gradient updates, the training computation itself, and the model's internal reasoning. It governs actions that cross the execution boundary, and only those that pass through it.\n\n## What is enforced today\n\n- Every Directory tool call goes through one runner. A token is checked on every call: its chain is recomputed from the root and compared in constant time, and every caveat must hold. An unknown caveat is a refusal, never a pass.\n- Refusals are written before anything is sent. On 3 October 2026 a run was refused on the caveat `task = T-0229`, 21 minutes after that task closed, and the refusal is on the task's record.\n- Requests, outbound calls and tool runs are recorded at the request boundary as exact bytes, stored once under their SHA-256. The build's own secret values are replaced by their names.\n- The coding tool runs as a compound tool, with hash-checked writes and detached jobs.\n\n## The containment boundary: what is prohibited, what is recorded, what is outside\n\n| | What the infrastructure does |\n|---|---|\n| **Can prohibit** | Any tool call that goes through the runner: a tool, door or interface the token does not name; an argument outside its rule; a path outside its area; a use past its count or expiry; any call once its task is done; a token widened by its holder. The refusal happens before anything is sent. |\n| **Records** | Every call through the runner and every refusal, with the caveat that refused it; the exact request and answer bytes of requests, outbound calls and tool runs, stored once under their SHA-256, with the build's secret values replaced by their names. |\n| **Outside enforcement** | Model weights, gradient updates, the training computation and the model's internal reasoning. Any action that does not cross the runner: agents still holding the build key (all of them today), raw shell tools and device doors the build key reaches directly, shell text that names a path, and network egress not forced through the runner. Events lost if a Worker is killed before its deferred write. |\n\nThe implemented part is a permission checker that refuses and records. Containing a model is the further claim that it has no other way out, and that claim is untested.\n\n## What full containment would still require\n\nThe primitives exist. Demonstrating that they contain a model means testing the whole boundary, and that work is not done. Stated plainly:\n\n1. **Every agent on a scoped token, and the build key withdrawn from agents.** Today no running agent has been switched.\n2. **No path around the runner.** Raw shell tools, and device doors reachable directly with the build key, are bypasses unless a token excludes them. Path limits check path-named arguments, not the text of a shell command.\n3. **Egress forced through the runner.** Network and filesystem access from an agent's container must be limited to the runner. Otherwise any tool that fetches an arbitrary URL is an exit.\n4. **Task binding on the live task store.** The checker reads tasks from the document the task list was kept in before it moved to a database table.\n5. **Evidence that cannot be lost.** By default, events are written after the answer goes out, so a Worker killed before the write loses them. Inbound webhooks already await the write. Containment evidence should too.\n6. **An adversarial test of the boundary.** A model given only a token and told to exceed it, with every attempt counted and every success treated as a defect. Not yet run.\n\n## Prior work\n\nThe token is the macaroon construction (Birgisson et al., NDSS 2014): caveats that attenuate and confine a bearer credential. Least privilege is a long-standing security principle. Excessive agency is a named risk for LLM applications. Programmatic tool calling and code execution with MCP are the current industry route for efficient tool use. What this build adds is the combination: authority checked outside the model, actions as declared operations, and a record the model does not write, all on one execution path." ], "sources": [ { "id": "s1", "url": "https://genai.owasp.org/llmrisk/llm062025-excessive-agency/", "title": "OWASP Top 10 for LLM Applications: LLM06 Excessive Agency", "publisher": "OWASP GenAI Security Project", "quote": "Excessive Agency is the vulnerability that enables damaging actions to be performed in response to unexpected, ambiguous or manipulated outputs from an LLM", "quote_sha256": "16c5966865aba67ea5c987f618e64f02980a508eae4639f0a7479508177ecf8a", "http_status": 200, "snapshot_sha256": "572174c673806c547c53e184a8723f44f72df854a5e1608a0eeafefbf0fa13ec", "snapshot_bytes": 365898, "quote_found": true, "verified_at": "2026-10-09T02:25:16.645Z" }, { "id": "s2", "url": "https://genai.owasp.org/llmrisk/llm062025-excessive-agency/", "title": "OWASP: the three root causes of excessive agency", "publisher": "OWASP GenAI Security Project", "quote": "excessive functionality; excessive permissions; excessive autonomy", "quote_sha256": "0651a596f4020d36eeb41177f42b9324a962c56e96f3651f2f8569bdc6ee5df7", "http_status": 200, "snapshot_sha256": "572174c673806c547c53e184a8723f44f72df854a5e1608a0eeafefbf0fa13ec", "snapshot_bytes": 365898, "quote_found": true, "verified_at": "2026-10-09T02:25:16.662Z" }, { "id": "s3", "url": "https://csrc.nist.gov/glossary/term/least_privilege", "title": "NIST glossary: least privilege", "publisher": "NIST CSRC", "quote": "A security principle that a system should restrict the access privileges of users (or processes acting on behalf of users) to the minimum necessary to accomplish assigned tasks.", "quote_sha256": "ba38f67b681f7c8dcc605f3f86d895385b4d3ecbfb32fcf8d39ab678302456bd", "http_status": 200, "snapshot_sha256": "2ece43d9b2f15dc314542221df3e39de741d792bd7b4aff60fc5475d15612ae7", "snapshot_bytes": 46560, "quote_found": true, "verified_at": "2026-10-09T02:25:16.514Z" }, { "id": "s4", "url": "https://docs.claude.com/en/docs/agents-and-tools/tool-use/programmatic-tool-calling", "title": "Claude docs: programmatic tool calling", "publisher": "Anthropic", "quote": "Programmatic tool calling allows Claude to write code that calls your tools programmatically within a code execution container", "quote_sha256": "00dcf45c0d90bd91749274a888694f5d921a2711e04a5de2a1c7d6fa2537da63", "http_status": 200, "snapshot_sha256": "67dbc9cdb537326f7582e3bc132ca946cbc7ebc97f0de0b8aef1c9652e8dcfc8", "snapshot_bytes": 1580369, "quote_found": true, "verified_at": "2026-10-09T02:25:16.662Z" }, { "id": "s5", "url": "https://www.anthropic.com/engineering/code-execution-with-mcp", "title": "Anthropic engineering: code execution with MCP", "publisher": "Anthropic", "quote": "The agent can then write code to interact with MCP servers.", "quote_sha256": "72120899d5ccd3d26ed158275a7fe76e63dfb6f8d127d2bb04abd179cbd83ef5", "http_status": 200, "snapshot_sha256": "9bfd99dcbe06f90ce17b56c60cfd340824936b2326819ce879caf59ae518fd1a", "snapshot_bytes": 174220, "quote_found": true, "verified_at": "2026-10-09T02:25:16.628Z" }, { "id": "s6", "url": "https://research.google/pubs/macaroons-cookies-with-contextual-caveats-for-decentralized-authorization-in-the-cloud/", "title": "Macaroons (Google Research, NDSS 2014)", "publisher": "Google Research", "quote": "macaroons embed caveats that attenuate and contextually confine when, where, by who, and for what purpose a target service should authorize requests", "quote_sha256": "c9d336b5640d0404bddb744bb47705d717cd772a618f8ef1166232c44cb6a0f7", "http_status": 200, "snapshot_sha256": "842c0b3dc187c9f12e555b35206dbec7944482160e20e237f58e1395ae06c4ab", "snapshot_bytes": 143498, "quote_found": true, "verified_at": "2026-10-09T02:25:16.628Z" }, { "id": "s7", "url": "https://miscsubjects.com/a/scoped-access", "title": "Scoped access: no running agent switched yet", "publisher": "miscsubjects.com", "quote": "No running agent of this build has been switched to scoped tokens", "quote_sha256": "8f8e1b185216aed684a3daf37ea4274fdccd38a6c9de08dfcd42d1ba9965f3a5", "http_status": 200, "snapshot_sha256": "d733dbf4f85038ba0170511721c9b90a41a9fbdea21e4565219dc0fd939ca674", "snapshot_bytes": 53854, "quote_found": true, "verified_at": "2026-10-09T02:25:16.572Z" }, { "id": "s8", "url": "https://miscsubjects.com/a/scoped-access", "title": "Scoped access: shell tools and area limits", "publisher": "miscsubjects.com", "quote": "do not give shell tools to a token you limit by area", "quote_sha256": "d455fd8cb976b315b4285b2ddbc9667ce068800d1e2ea561b6aa928b95ad46c2", "http_status": 200, "snapshot_sha256": "b82032b68699a79b67ef97a19d77c974e4ae05550328bdd00f2cb76f2a1822f2", "snapshot_bytes": 53854, "quote_found": true, "verified_at": "2026-10-09T02:25:16.590Z" }, { "id": "s9", "url": "https://miscsubjects.com/a/scoped-access", "title": "Scoped access: unknown caveats are refusals", "publisher": "miscsubjects.com", "quote": "A caveat this build does not know is a refusal, never a pass.", "quote_sha256": "7017355676c5fb68ccb450bd00e64622d59ad45b39d491dc155e09c34be9c4d7", "http_status": 200, "snapshot_sha256": "ea00fe9caa4c25c7448cf73907eb5908a292af6d2e256d2033cd92f6c089f786", "snapshot_bytes": 53854, "quote_found": true, "verified_at": "2026-10-09T02:25:16.572Z" }, { "id": "s10", "url": "https://miscsubjects.com/a/scoped-access", "title": "Scoped access: the task record", "publisher": "miscsubjects.com", "quote": "The worker could not leave a call out, because it could not act without the token, and it could not add one, because the build writes the record.", "quote_sha256": "3c09e45853488de9107f4ccdabb8d62a199798b5ade635b7a7c63ba192c08ca4", "http_status": 200, "snapshot_sha256": "c1fab38e402fa68cd330bcb62c06a8fd032bf64d98d465303ffd5c0e6786362d", "snapshot_bytes": 53854, "quote_found": true, "verified_at": "2026-10-09T02:25:16.592Z" } ], "type": "article", "created": "2026-10-09T02:25:15.474Z", "updated": "2026-10-09T03:29:43.378Z", "version": 4, "hash": "613c1c5cb4bcdd2aa6e2e81c01b8a2bb1cd248e8a9b06ea1b4f1196391f55570", "styling": { "scope": "shared", "how": "no value on the page is set by hand: each comes from this theme, and each theme value becomes the CSS variable named beside it. PATCH https://miscsubjects.com/api/jarticles/theme changes them.", "widget_style": { "what": "every widget may carry style: {…}; these are the only keys it reads", "rotate": "degrees, a number", "offset_x": "pixels, a number", "offset_y": "pixels, a number", "pulse": "true to pulse" }, "theme": { "color": { "page_bg": "#f5f5f7", "sheet_bg": "#ffffff", "ink": "#1d1d1f", "soft": "#424245", "muted": "#6e6e73", "dim": "#86868b", "line": "#d2d2d7", "accent": "#0071e3", "accent_soft": "rgba(0,113,227,0.08)", "link": "#0066cc", "selection": "rgba(0,113,227,0.18)", "widget_bg": "#f5f5f7", "widget_border": "#d2d2d7", "card_bg": "#ffffff", "code_bg": "#f5f5f7", "json_bg": "#161b19", "json_ink": "#e6e1d4", "json_key": "#7fd3c3", "json_string": "#e9c46a", "json_number": "#f4a261", "json_bool": "#c792ea", "json_null": "#928d7e", "json_punct": "#6b6759", "json_bar": "#0e1512", "kind_badge_bg": "#0e6e60", "kind_badge_ink": "#ffffff" }, "color_dark": { "page_bg": "#000000", "sheet_bg": "#1d1d1f", "ink": "#f5f5f7", "soft": "#d2d2d7", "muted": "#a1a1a6", "dim": "#86868b", "line": "#424245", "accent": "#2997ff", "accent_soft": "rgba(41,151,255,0.12)", "link": "#2997ff", "selection": "rgba(41,151,255,0.25)", "widget_bg": "#2c2c2e", "widget_border": "#424245", "card_bg": "#1d1d1f", "code_bg": "#2c2c2e", "json_bg": "#0a0d0c", "json_ink": "#e6e1d4", "json_key": "#7fd3c3", "json_string": "#e9c46a", "json_number": "#f4a261", "json_bool": "#c792ea", "json_null": "#757062", "json_punct": "#5d665f", "json_bar": "#060807", "kind_badge_bg": "#4fc1ab", "kind_badge_ink": "#0b0f0d" }, "font": { "display": "-apple-system,BlinkMacSystemFont,\"SF Pro Display\",\"SF Pro Text\",\"Helvetica Neue\",Helvetica,Arial,sans-serif", "body": "-apple-system,BlinkMacSystemFont,\"SF Pro Display\",\"SF Pro Text\",\"Helvetica Neue\",Helvetica,Arial,sans-serif", "mono": "ui-monospace,SFMono-Regular,\"SF Mono\",Menlo,Consolas,monospace", "google_fonts": "" }, "size": { "body": "17px", "small": "17px", "eye": "17px", "lead": "17px", "h1": "52px", "h2": "34px", "h3": "22px", "byline": "17px", "h1_measure": "none", "code": "17px", "json": "17px", "widget_title": "17px" }, "leading": { "body": "1.7", "head": "1.18", "lead": "1.5", "json": "1.6" }, "weight": { "display": "700", "head": "700", "body": "400", "strong": "700", "eye": "700" }, "tracking": { "eye": "0.14em", "display": "-0.03em", "body": "-0.006em", "badge": "0.08em" }, "layout": { "sheet_width": "1000px", "text_width": "880px", "gutter": "16px", "sheet_padding": "56px 64px 64px", "sheet_padding_mobile": "24px 18px 40px", "sheet_margin": "28px auto 72px", "block_gap": "1.15em", "widget_gap": "28px", "grid_gap": "14px" }, "border": { "sheet": "0px solid", "sheet_radius": "30px", "widget": "1px solid", "widget_radius": "24px", "card_radius": "24px", "badge_radius": "999px", "rule": "1px solid", "code_radius": "18px", "accent_bar": "3px" }, "shadow": { "sheet": "0 1px 1px rgba(0,0,0,.02),0 6px 26px rgba(0,0,0,.05)", "widget": "none", "card_hover": "0 10px 28px -16px rgba(28,27,23,0.35)" }, "motion": { "hover": "160ms ease" } } }, "page": "https://miscsubjects.com/a/authority-outside-the-model", "json": "https://miscsubjects.com/a/authority-outside-the-model.json", "markdown": "https://miscsubjects.com/a/authority-outside-the-model.md", "theme": "https://miscsubjects.com/article-theme.json", "calls": [ { "what": "this article as a page (no key)", "method": "GET", "url": "https://miscsubjects.com/a/authority-outside-the-model", "headers": {} }, { "what": "this article as its object (no key)", "method": "GET", "url": "https://miscsubjects.com/a/authority-outside-the-model.json", "headers": {} }, { "what": "this article as Markdown (no key)", "method": "GET", "url": "https://miscsubjects.com/a/authority-outside-the-model.md", "headers": {} }, { "what": "the object with its hash, drafts too", "method": "GET", "url": "https://miscsubjects.com/api/jarticles/authority-outside-the-model", "headers": { "x-sheets-key": "$(cat /Users/cyrusmassoumi/.misc-sheets-key)" } }, { "what": "one piece and that piece’s hash", "method": "GET", "url": "https://miscsubjects.com/api/jarticles/authority-outside-the-model/at?path=facts", "headers": { "x-sheets-key": "$(cat /Users/cyrusmassoumi/.misc-sheets-key)" } }, { "what": "grep: every key or value that matches, with the path to change it", "method": "GET", "url": "https://miscsubjects.com/api/jarticles/authority-outside-the-model/grep?q=owner", "headers": { "x-sheets-key": "$(cat /Users/cyrusmassoumi/.misc-sheets-key)" } }, { "what": "change pieces (set, merge, delete, append, insert, move); if-match is the hash", "method": "PATCH", "url": "https://miscsubjects.com/api/jarticles/authority-outside-the-model", "headers": { "x-sheets-key": "$(cat /Users/cyrusmassoumi/.misc-sheets-key)", "content-type": "application/json", "if-match": "" }, "body": { "ops": [ { "op": "set", "path": "facts.example", "value": 1 } ] } }, { "what": "replace the whole object", "method": "PUT", "url": "https://miscsubjects.com/api/jarticles/authority-outside-the-model", "headers": { "x-sheets-key": "$(cat /Users/cyrusmassoumi/.misc-sheets-key)", "content-type": "application/json", "if-match": "" }, "body": { "slug": "authority-outside-the-model", "title": "…" } }, { "what": "fetch every source, hash what came back and check the quote is in it", "method": "POST", "url": "https://miscsubjects.com/api/jarticles/authority-outside-the-model/verify", "headers": { "x-sheets-key": "$(cat /Users/cyrusmassoumi/.misc-sheets-key)", "content-type": "application/json" }, "body": {} }, { "what": "an Obsidian-style command", "method": "POST", "url": "https://miscsubjects.com/api/jarticles/cli", "headers": { "x-sheets-key": "$(cat /Users/cyrusmassoumi/.misc-sheets-key)", "content-type": "application/json" }, "body": { "command": "backlinks", "file": "authority-outside-the-model" } } ] }