Section 01 · the wrong place for safety
Safety in the prompt vs safety at the gate.
prompt asks nicely · gate enforces
Prompts are suggestions. Policy gates are walls.
Section 02 · the gate flow
Every action runs through the gate.
action proposal → policy → decision · logged
No bypass. No "the model decided." Every gate decision is the rule that fired.
Section 03 · the grounding floor
No source, no action.
Bloomberg · every output traces to authoritative data before it can act
A non-negotiable floor. Hallucination is unsourced output. If it cannot cite, it cannot act.
Section 04 · dual-identity propagation
Workload and user. Both stamped.
every call carries two principals - never one
"The agent did it" is not an audit trail. Who delegated, who acted, what scope - all three, every call.
Section 05 · the authz matrix
Who can call what. IT decides.
IT decides who reaches what · not the agent
Each agent gets only the doors IT opens for it.
Section 06 · what a policy looks like
One policy · four moving parts.
one rule, the four moving parts
Same shape as English. No model can negotiate around it.
Section 07 · the kill switch
One flip, agent stops shipping.
per-agent, per-scope, per-action-class · drilled quarterly
If you've never run the drill, you don't have a kill switch.
Section 08 · humans at the edges
Two human roles. No middle.
coordination layers compress · ICs and DRIs remain
IC = builder who ships. DRI = single accountable owner. The brain handles coordination.
Section 09 · tools 2026
The OSS picks.
expressive DSL ↑↓ verbose Rego · OSS ←→ SaaS
Cedar's DSL was designed for authorization, not for generic policy. It shows.
Section 10 · vollko OSS
The primitives.
agent-attestation ☆
cryptographic action receipts · audit-grade
agent-toolprint
DSSE-signed tool-call receipts (ts/py/rs)
mcp-provenance
signed MCP capability declarations
agent-id
DID + capability VC profile
prompt-shield
prompt-injection detector at edge
loop-guardrail
trip when agent loops repetitively
· · ·
Build the AI-native firm