Narrow In, Narrow Out

The premise is the leak

The question is a good one because it is the right fear, aimed at the wrong machine. It assumes the defense is a smarter guard wrestling a smarter agent in an open field — that whoever argues better, wins. Under that assumption the question has no answer, and the questioner knows it. Prompt against prompt is an arms race measured in eloquence, and eloquence is the one resource the model holds in unlimited supply.

Every defense built out of language inherits language’s breadth. A system prompt is a paragraph of hopes; an agent smarter than the paragraph reads it as a menu of edges. The objection that follows — the master’s tools will never dismantle the master’s house — is correct about tools made of words. Verity’s checker is not made of words. It is made of placement and arithmetic: a small, deterministic gate outside the transformer, holding a signature it did not issue and a mandate it cannot amend. There is nothing in it to persuade. A hash does not care how the request is phrased.

So the contest the question imagines — agent cleverness against gate cleverness — is declined at the level of architecture. What replaces it is duller and stronger: comparison. A proposal arrives. It is compared, exactly, against an intention that was written down, signed, and fixed before the agent was switched on. It matches, or it doesn’t. Cleverness is not a credential the comparison accepts.

Narrow in: limit the scope from the start

The outsmarting scenario smuggles its real assumption in at the door: an agent handed a broad mandate — go anywhere, touch anything, improvise the mission — which must then be policed at the exit by something smarter than it is. Build that way and the question is unanswerable, because the problem was manufactured at intake.

Limit the scope from the start, and you do not have the problem. The front gate takes an attestation before anything runs: who is asking, for what, within which bounds — signed by the sovereign, sealed, uneditable. The agents Verity verifies are pre-verified and narrow on purpose: a small mandate, a small toolset, a short list of things in the world they are permitted to propose. The model’s intelligence is not limited; its commission is. A brilliant agent with a narrow commission is a specialist. A brilliant agent with an unlimited one is a liability looking for a doorway.

Breadth is where the second intent hides. Scope is not the cage around the work. Scope is the size of the door the work is allowed to want.

Narrow out: the request must be specific

What crosses the back gate is not “output.” It is a proposal, and a proposal has to be specific: this action, on this object, for this amount, under this attestation. Specificity is what makes a proposal checkable — it can be laid against the signed intention line by line, the way a receipt is laid against a purchase order.

A broad request cannot be checked, so a broad request does not cross. It is refused on breadth alone — not as a failure mode, but as the mechanism working in its plainest form. Do something reasonable with the account is not a proposal; it is a fog, and fog is exactly the medium in which a second, unsigned intention travels. The gate does not have to detect the smuggling. It declines the fog.

Assume the evasion. Price it small.

None of this requires the agent to be well-behaved, and the design does not ask it to be. Assume the agent will try to evade — they will, the way water tries the seams of a pipe. The question is never whether pressure exists. The question is what the pressure can reach.

Narrow scope is what the pressure reaches. Inside a small mandate, the worst day is a small day: the tools are few, the money bands are capped — in the live rules, a proposal over threshold does not get argued with; it gets escalated to a human — and every attempted crossing, allowed or not, is written to a signed chain the agent cannot edit. Evasion inside a narrow room produces a narrow incident and a complete receipt.

Narrow scope is narrow attack.

Amputate what is compromised

And when a limited system is compromised — some will be; the design assumes that too — the remedy is proportional, because the unit is small. Its attestation is revoked. It is cut off from the chain. Amputate the limb: the body was never asked to trust the limb with more than its scope, so the body does not fall with it.

This is the arithmetic the broad architecture can never do. One general agent, compromised, is a total event — everything it could touch is in question. A fleet of narrow agents is a portfolio of small, survivable events, each one sealed in its own record, each one removable without ceremony. Separated cognition is not an aesthetic. Small units are how you make failure cheap enough to afford honesty about it.

The door is the doctrine

So: what prevents the agent from outsmarting the gate? Nothing prevents it from trying. What prevents the trying from mattering is that there is no open field for it to matter in — a signed intention at the entrance, a narrow commission behind it, a specific proposal at the exit, a gate that compares instead of debating, and a chain that remembers every attempt. The agent can be as brilliant as it likes inside its room. The room was sized by somebody else, and the door is the size it is.

The master’s-tools argument ends where it always had to end: do not build the guard out of the guarded thing’s materials. Build a doorframe. Frames do not get out-argued.