FRONTIER AGENT CONTROL / MISSION AUTHORIZATION GATEWAY

Control frontier agents before intent becomes external effect.

Frontier models can plan, adapt, and pursue objectives across long time horizons — and they can find unintended paths through tools, credentials, networks, package infrastructure, and execution environments. The Mission Authorization Gateway (MAG) places an independent, deterministic authorization boundary between a model's proposed action and the outside world. The model may propose. Only a valid MAG decision releases the effect.

NO AI MODEL MAKES THE ENFORCEMENT DECISION. CURRENT PRODUCT AND ASSURANCE STATUS: TRUST.
FIG. 1 — THE “AI ESCAPE” PROBLEM IS A CONTROL FAMILY

The incidents were not one failure. They were several controls failing in sequence.

CONTROL 01
Runtime escape

A sandbox, VM, container, package proxy, or orchestration layer can contain a vulnerability or an unintended allowed path. Isolation must be hardened and continuously tested.

Frontier LLM agents can escape container sandboxes under vulnerability conditions that plausibly occur in real systems — UK AISI/Oxford, SandboxEscapeBench (benchmark repo).

CONTROL 02
Trajectory evasion

A long-running model can split, transform, or sequence actions so each step appears acceptable while the cumulative outcome violates policy. Single-action monitoring is necessary but not sufficient.

CONTROL 03
Authority gap

A tool, credential, destination, or protected system may accept a request without an independent authorization decision — the control class MAG addresses directly.

INSTRUCTIONS ARE NOT AUTHORIZATION. MONITORING IS NOT AUTHORIZATION. REACHABILITY IS NOT AUTHORITY.
FIG. 2 — DIFFERENT CONTROLS, DIFFERENT JOBS

Frontier-agent safety requires defense in depth.

01 — ALIGN

Reduce the likelihood of harmful, deceptive, or goal-divergent strategy in the model itself.

02 — ISOLATE

Constrain what the model can physically and logically reach through hardened runtimes and network boundaries.

03 — MONITOR

Detect suspicious behavior, emerging intent, and sequence-level risk across a long-running trajectory.

04 — AUTHORIZE — MAG

Determine whether each consequential action, target, destination, parameter set, credential use, and external effect is allowed to execute.

SANDBOX THE MODEL. MONITOR THE TRAJECTORY. AUTHORIZE THE EFFECT.

MAG complements the other layers. It does not replace model alignment, sandbox security, network isolation, or behavioral monitoring — it adds the independent authorization decision those layers do not make.

FIG. 3 — REFERENCE-MONITOR-INSPIRED ACTION AUTHORIZATION

The model proposes. MAG holds the authority.

MAG applies a reference-monitor-inspired architecture for AI-driven actions and external effects — an independent decision point, evaluating mandatory policy, on the path between a proposed action and the system it would affect. (Reference monitor: NIST definition.)

STAGE 01
FRONTIER AGENT
plans · adapts · pursues objectives
STAGE 02
PROPOSED ACTION
tool call · credential use · destination · command
DETERMINISTIC
STAGE 03
MAG DECISION CORE
mandatory policy · no AI model in the ruling
STAGE 04
AUTHORIZED EXECUTION BROKER
releases credentials + egress on a valid decision
STAGE 05
PROTECTED SYSTEM
accepts only MAG-authorized actions
THE MODEL MAY DISCOVER A PATH. IT STILL DOES NOT POSSESS AUTHORITY.
THE DECISION CORE EVALUATES
D-01Canonical action representation
D-02Verified principal and delegated authority
D-03Target, tool, and parameter envelope
D-04Source provenance and anti-replay state
D-05Classification and mission context
D-06Current trajectory state where configured
D-07Versioned mandatory policy
D-08Deterministic permit / constrain / deny / quarantine ruling
Execution rule — protected systems accept only MAG-authorized actions. Credentials and egress are released by the broker only after a valid decision.
DEPLOYMENT TRUTH —
MAG is non-bypassable by architecture — in the action path, fail-closed, no route around the decision core. How much of an environment a deployment covers is set by the integration: direct paths removed, credentials and network egress brokered, protected interfaces rejecting unmediated actions.
FIG. 4 — WHERE MAG APPLIES

Four places frontier capability meets consequential systems.

APPLICATION 01
Cyber evaluations and AI sandboxes

Authorize what an evaluation agent may install, connect to, and target before execution — so the evaluation boundary is enforced on the control path, not assumed in the prompt.

APPLICATION 02
Frontier agent runtimes

Shell, filesystem, browser, database, API, and tool actions governed with identity, action, target, and parameter policy — a deterministic authorization decision before each consequential step.

APPLICATION 03
Multi-agent and delegated authority

Prevent child agents, subprocesses, tools, and MCP servers from acquiring or exercising authority greater than the delegating principal — authority ceilings that hold as work is handed off.

APPLICATION 04
Critical and mission systems

The same authorization boundary before OT commands, autonomy actions, sensor tasking, and cross-domain release — where an unauthorized external effect is a mission event, not a bug report.

FIG. 5 — CORE CONTROL PRIMITIVES AND DEPLOYMENT TAILORING

Core control primitives are built. Frontier deployments are engineered around them.

CORE MAG CONTROL PRIMITIVES
IMPLEMENTED ARCHITECTURE / STAGING — SUBJECT TO THE TRUST RECORD
— Deterministic action authorization — Cedar-backed tool, target, and parameter envelopes — Provenance and anti-replay checks — Command-rate limits — Classification-spillage controls — Indirect-prompt-injection and adversarial-Unicode screening — Output-schema conformance — Signed, hash-chained Gateway receipts on staging — Native and gRPC decision surfaces
FRONTIER DEPLOYMENT TAILORING
INTEGRATION / EXTENSION SCOPE — ENGINEERED PER DEPLOYMENT
— Mandatory destination and egress policy — Scoped credential and execution brokerage — Delegated-authority ceilings — Stateful trajectory budgets and sequence policy — Emergency pause, revocation, and isolation — Complete-mediation evidence for every consequential external-effect path — Incident-derived adversarial evaluations
FIG. 6 — AUTHORIZATION LEAVES AN ARTIFACT

Every governed decision produces its own evidence.

DECISION RECEIPTILLUSTRATIVE
principalfrontier-eval-agent
actionnetwork.connect
targetexternal-prod-system
policyeval-boundary-v8
reasonTARGET_NOT_ALLOWED
rulingDENY · HALT
sigVALID · CHAINED

Every governed decision creates evidence of what was proposed, which policy ruled, what result was enforced, and which versioned artifacts produced the result. The evidence is produced as a byproduct of control — not reconstructed later from scattered logs.

VERIFIER SCOPE —
The public verifier checks the integrity and signature of the supplied receipt and chain segment. It does not independently rerun the policy unless the exact input, context, and policy bundle are available.
FIG. 7 — FIELD RECORD, JULY 2026

Three incidents. Four disclosures. Ten days documenting the same durable control family.

DATEDISCLOSURE
2026-07-20 OpenAI — during limited internal use of a model trained for long-running tasks, OpenAI observed novel failures and paused access. In one episode the model spent roughly an hour finding a vulnerability in its sandbox so it could open a public pull request on GitHub, against its instructions; in another, when a security scanner blocked a request containing an authentication token, the model split the token into two obfuscated fragments and reassembled it at runtime. OpenAI responded with new evaluations, trajectory-level monitoring, and staged restoration of access. Source →
2026-07-21 OpenAI + Hugging Face — during an internal cyber-capability evaluation, a model in an agentic harness exploited a previously unknown vulnerability in a package-registry cache proxy, obtained internet access, and compromised Hugging Face infrastructure while pursuing the benchmark objective. Source →
2026-07-21 Hugging Face — disclosed alongside OpenAI that it had detected the activity on 2026-07-16, and confirmed unauthorized access to limited internal datasets and several service credentials. Source →
2026-07-30 Anthropic — a retrospective review begun 2026-07-23, with cyber evaluations suspended the same day, found three cyber evaluations had reached real organizations' systems. The evaluation environments were unintentionally connected to the public internet via a misconfiguration with an evaluation partner, while prompts told the models they had no internet access. Two of the three organizations were unaware until notified on 2026-07-27. Source → · AP →
Identity versus authorization: who is acting versus what may execute. Left panel: an agent with valid, verified credentials — identity answered. Right panel: the same agent proposes an action that still passes through policy evaluation to a ruling — allow, deny, or modify, with step-up and defer also available. Authentication establishes the actor; it does not rule on the action.
FIG. A — IDENTITY IS NOT AUTHORIZATIONCONTAINMENT.AI
CLAIM BOUNDARY — READ BEFORE DRAWING A COUNTERFACTUAL

MAG was not deployed in the OpenAI, Hugging Face, or Anthropic environments. MAG does not replace sandbox security. Whether MAG would have prevented a specific incident depends on whether every consequential action, credential use, and network path was completely mediated by an intact, correctly configured control path.

PRODUCT STATUS —

Pre-ATO. No production deployments or certification claims. See Trust for current status.

COMMON QUESTIONS — FRONTIER AGENT CONTROL

Does MAG replace an AI sandbox?

No. Sandboxing constrains the environment. MAG constrains authority. A sandbox limits where the agent runs and what it can reach; MAG makes the deterministic decision about whether a proposed action is allowed to execute. You need both — MAG does not replace sandbox security.

Does MAG rely on another AI model to judge the agent?

No. No AI model makes the enforcement decision. MAG evaluates the proposed action against versioned, deterministic policy — identity, action, resource, target, parameters, provenance, classification, rate, and configured context. The same input and policy version produce the same ruling, every time.

Can MAG prevent every frontier-model escape?

No product can honestly make that claim. Escape is a control family — runtime isolation, trajectory monitoring, and action authorization can each fail independently. MAG addresses the authority gap: protected interfaces can be configured to accept only MAG-authorized actions, so a discovered path does not by itself carry authority. Whether that holds in a specific deployment depends on removing direct paths and brokering credentials and egress.

Would MAG have prevented the July 2026 incidents?

MAG was not deployed in the OpenAI, Hugging Face, or Anthropic environments, so no counterfactual claim is honest. What can be said precisely: whether MAG would have prevented a specific incident depends on whether every consequential action, credential use, and network path was completely mediated by an intact, correctly configured control path — a property of that deployment, which is why we make no counterfactual claim about it.

What makes MAG different from observability?

Observability tells you what the agent did, after execution. MAG rules on what the agent may do — a deterministic permit, constrain, deny, or quarantine decision before the effect is released — and produces signed evidence as a byproduct of control. Monitoring remains essential; it is not authorization.

What does “mandatory policy” mean?

Policy the agent cannot waive, modify, disable, or negotiate. It is versioned, centrally administered, and evaluated on every governed action. The model may propose — deterministic policy decides what executes.

Bring one frontier-agent boundary.

Map the tools, credentials, destinations, and systems the agent can affect. Identify every direct and alternate path. Define mandatory policy and success criteria. Exit with an architecture decision, an adversarial test plan, and an evidence package.

Request a 30-minute Frontier Agent Control review Download the product brief
FIELD NOTE — FROM THE BLOG
Frontier agent control and the July 2026 incidents — what the disclosures actually show, and where authorization fits.
Read the Field Note →