THE MODEL MAY THINK.AUTHORITY STAYS OUTSIDE THE MODEL.
Agentic Execution Governance ist ein eigenständiger sektoraler Bereich der immo.quick Serverless Edition. Er kontrolliert nicht, was ein Modell denkt. Er kontrolliert die unabhängige Grenze, an der Modell-Intent zu externer Wirkung werden darf.
LET THE LLM WORK. DO NOT LET IT AUTHORIZE ITS OWN WAY OUT.
AEG is designed for the class of autonomous breakout scenarios that operators of advanced LLM platforms must contain. Whether the underlying model is from OpenAI, Anthropic/Claude, or another provider, the model may continue to reason, plan, use approved tools and operate normally inside its permitted environment. What changes is the boundary to the outside world: model output, tool intent or autonomous behavior cannot by itself become execution authority. External effect requires a valid, current and independently enforced Execution Right.
Common ERI enforcement kernel. Separate agentic semantics. Independent authority. Scoped capabilities. Current right at effect. Append-only evidence.
AI Safety asks whether the model behaves. AEG asks whether behavior is authorized to become effect.
The agent is treated as potentially compromised, prompt-injected, memory-poisoned, RAG-poisoned, tool-poisoned, colluding or actively attempting privilege escalation. Model output remains untrusted intent. Authority is established outside the model and must still be current at the point of effect.
The governed system does not govern its governor.
Intent
LLM, runtime, planner, memory, RAG, tool selection, multi-agent messages and model output. Classified as UNTRUSTED_EXECUTION_INTENT or OBSERVED_EVIDENCE.
Authority
Authority sources, policies, rules, delegations, revocations, mandates, approvals, jurisdiction state and governance versions.
Right → Capability
Execution Right Closure, action normalization, point-of-execution revalidation, capability issuance, nonce reservation and atomic consumption.
Receipt
Append-only Execution Receipts bind closure, authority version, capability, nonce, revalidation and observed outcome.
Model intent never skips directly to effect.
18 deterministic rules. Separate from the universal ERI invariant registry.
Each invariant has an explicit enforcement purpose and deterministic violation reason. The current implementation routes all supported AEG execution surfaces through the common server-side enforcement function.
AEG-INV-001MODEL_REQUEST ≠ EXECUTION_AUTHORITY
Model output or agent request never creates authority.
AEG-INV-002AGENT_CANNOT_GRANT_OWN_AUTHORITY
An agent may request authority but cannot grant it to itself.
AEG-INV-003AGENT_CANNOT_EXPAND_OWN_SCOPE
Action, resource, purpose and jurisdiction scope cannot be self-expanded.
AEG-INV-004AGENT_CANNOT_APPROVE_OWN_EXCEPTION
The requesting agent cannot be the final authority for its own exception.
AEG-INV-005MODEL_MEMORY ≠ AUTHORITY
Memory assertions do not become current authority.
AEG-INV-006RAG_CONTENT ≠ AUTHORITY
Retrieved content cannot directly create authority or applicable governance state.
AEG-INV-007TOOL_OUTPUT ≠ AUTHORITY
Tool output is observation or evidence, not authority by itself.
AEG-INV-008CAPABILITY_SCOPE ⊆ EXECUTION_RIGHT_SCOPE
Issued capability scope cannot exceed the closed Execution Right.
AEG-INV-009DELEGATED_SCOPE ⊆ DELEGATOR_SCOPE
Delegation cannot create authority that the delegator does not possess.
AEG-INV-010AGENT_COMPROMISE ≠ GOVERNANCE_AUTHORITY
Compromise of an agent does not by itself confer governance authority.
AEG-INV-011GOVERNANCE_CHANGE ⇒ INDEPENDENT_EXECUTION_RIGHT
Governance changes require an independently valid Execution Right.
AEG-INV-012NO_VALID_RIGHT ⇒ NO_VALID_CAPABILITY
No valid right means no valid capability may be issued.
AEG-INV-013NO_AUTHORIZED_EXECUTION_PATH ⇒ NO_EXTERNAL_EFFECT
Consequence-bearing effects require a governed execution path.
AEG-INV-014AGENT_EFFECT ⇒ CURRENT_RIGHT_AT_EFFECT
The right must still exist at the point of effect.
AEG-INV-015AGENT_EFFECT ⇒ REQUIRED_EVIDENCE_PRESERVED
Required evidence must be preserved for consequence-bearing actions.
AEG-INV-016AGENT_CANNOT_DISABLE_OWN_ENFORCEMENT
An agent cannot disable the enforcement path that governs its own actions.
AEG-INV-017AGENT_CANNOT_ERASE_REQUIRED_EVIDENCE
Required evidence cannot be erased by the governed agent.
AEG-INV-018KNOWLEDGE_OF_GOVERNANCE ≠ AUTHORITY_OVER_GOVERNANCE
Knowing the control model does not confer authority over it.
14 consequence-bearing surfaces. Unknown surfaces are rejected.
TOOL INVOCATION
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
CODE EXECUTION
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
NETWORK ACCESS
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
EXTERNAL API CALL
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
CLOUD INFRASTRUCTURE CHANGE
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
DATABASE MUTATION
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
DATA EXPORT
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
MESSAGE OR EMAIL TRANSMISSION
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
FINANCIAL TRANSACTION REQUEST
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
DEPLOYMENT OR RELEASE
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
AGENT TO AGENT DELEGATION
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
MODEL OR AGENT SELF MODIFICATION
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
GOVERNANCE CHANGE REQUEST
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
CREDENTIAL OR SECRET USE
Consequence-bearing execution surface governed through aegExecutionGateway → enforceAgenticExecution.
The test suite executes against the same enforcement source-of-truth as the gateway.
The live runner uses executable fixtures rather than hard-coded observed results. Each test traverses Fixture → executeAgenticEnforcement → Capability Decision → Execution Boundary → append-only Receipt.
This verdict is limited to the implemented boundary and the executed modeled scenarios. It is not a claim of universal AI safety, absence of unknown vulnerabilities, or independent certification.
The agentic sector sits on a currently green fail-closed execution boundary.
All modeled vectors denied; nonce reuse is a live regression case.
Applicable variants across 10 registered production execution surfaces.
Suites passed; overall_pass = true.
Fail-closed and bound to global conformance.
These are current internal verification results within the implemented and executed scope. They do not constitute independent certification or universal security assurance.
Effect is followed by append-only evidence.
AgentExecutionReceipt is enforced as non-updatable at the data-access layer. The receipt binds agent/model identifiers, execution surface, request and normalized intent hashes, action, resource, purpose, authority and rule versions, jurisdiction and dependencies, delegation, freshness, revocation epoch, closure, capability, nonce, revalidation, execution result and receipt chain references.
What the implementation supports — and what it does not claim.
Independent execution governance
14/14 registered surfaces wired; 18/18 AEG invariants enforced; capabilities issued only after validation; unknown surfaces rejected; receipts append-only; 45 live adversarial/positive-control outcomes matched expectation.
No universal AI-safety guarantee
No claim that AI cannot escape, that the system is unhackable, that all external facts are correct, that all unknown attack vectors are covered, or that public evidence is independent certification.
External authority and bypass environment
Compromised external authority sources remain a separate risk. Direct technical paths outside the enforcement boundary must be eliminated or independently constrained in deployment.
Agentic Execution Governance in one sentence.
Does AEG control what an AI thinks?
No. It governs whether model intent may become authorized external effect.
Can an agent grant itself more authority?
No. Authority expansion is a governance change and requires an independent Execution Right.
Does prompt injection disappear?
No. AEG does not claim to eliminate prompt injection. It is designed so that prompt compromise does not automatically become authority compromise.
Can an agent change its own policies?
It may request a governance change. It cannot independently authorize and activate that change.
What happens if authority changes while the agent is running?
Continuing Authority revalidation determines whether the right still exists at the point of effect.
What do the live tests prove?
They show that the modeled 40 attack scenarios and 5 positive controls produced the expected outcomes against the current enforcement path. They do not prove universal security.