Control frontier agents before intent becomes external effect.
Frontier models can plan, adapt, and pursue objectives across long time horizons — and they can find unintended paths through tools, credentials, networks, package infrastructure, and execution environments. The Mission Authorization Gateway (MAG) places an independent, deterministic authorization boundary between a model's proposed action and the outside world. The model may propose. Only a valid MAG decision releases the effect.
The incidents were not one failure. They were several controls failing in sequence.
A sandbox, VM, container, package proxy, or orchestration layer can contain a vulnerability or an unintended allowed path. Isolation must be hardened and continuously tested.
Frontier LLM agents can escape container sandboxes under vulnerability conditions that plausibly occur in real systems — UK AISI/Oxford, SandboxEscapeBench (benchmark repo).
A long-running model can split, transform, or sequence actions so each step appears acceptable while the cumulative outcome violates policy. Single-action monitoring is necessary but not sufficient.
A tool, credential, destination, or protected system may accept a request without an independent authorization decision — the control class MAG addresses directly.
Frontier-agent safety requires defense in depth.
Reduce the likelihood of harmful, deceptive, or goal-divergent strategy in the model itself.
Constrain what the model can physically and logically reach through hardened runtimes and network boundaries.
Detect suspicious behavior, emerging intent, and sequence-level risk across a long-running trajectory.
Determine whether each consequential action, target, destination, parameter set, credential use, and external effect is allowed to execute.
MAG complements the other layers. It does not replace model alignment, sandbox security, network isolation, or behavioral monitoring — it adds the independent authorization decision those layers do not make.
The model proposes. MAG holds the authority.
MAG applies a reference-monitor-inspired architecture for AI-driven actions and external effects — an independent decision point, evaluating mandatory policy, on the path between a proposed action and the system it would affect. (Reference monitor: NIST definition.)
Four places frontier capability meets consequential systems.
Authorize what an evaluation agent may install, connect to, and target before execution — so the evaluation boundary is enforced on the control path, not assumed in the prompt.
Shell, filesystem, browser, database, API, and tool actions governed with identity, action, target, and parameter policy — a deterministic authorization decision before each consequential step.
Prevent child agents, subprocesses, tools, and MCP servers from acquiring or exercising authority greater than the delegating principal — authority ceilings that hold as work is handed off.
The same authorization boundary before OT commands, autonomy actions, sensor tasking, and cross-domain release — where an unauthorized external effect is a mission event, not a bug report.
Core control primitives are built. Frontier deployments are engineered around them.
Every governed decision produces its own evidence.
Every governed decision creates evidence of what was proposed, which policy ruled, what result was enforced, and which versioned artifacts produced the result. The evidence is produced as a byproduct of control — not reconstructed later from scattered logs.
Three incidents. Four disclosures. Ten days documenting the same durable control family.
MAG was not deployed in the OpenAI, Hugging Face, or Anthropic environments. MAG does not replace sandbox security. Whether MAG would have prevented a specific incident depends on whether every consequential action, credential use, and network path was completely mediated by an intact, correctly configured control path.
Pre-ATO. No production deployments or certification claims. See Trust for current status.
Does MAG replace an AI sandbox?
Does MAG rely on another AI model to judge the agent?
Can MAG prevent every frontier-model escape?
Would MAG have prevented the July 2026 incidents?
What makes MAG different from observability?
What does “mandatory policy” mean?
Bring one frontier-agent boundary.
Map the tools, credentials, destinations, and systems the agent can affect. Identify every direct and alternate path. Define mandatory policy and success criteria. Exit with an architecture decision, an adversarial test plan, and an evidence package.