Toward trustworthy infrastructure for autonomous AI systems.

Autonomous AI systems are being deployed into environments — cloud infrastructure, CI/CD pipelines, production data stores — where a single unreviewed action can be irreversible. The dominant engineering response has been to improve the model: better prompts, better fine-tuning, better refusal behaviour. This paper argues that the reliability of an autonomous system is determined less by the competence of its policy than by the properties of the substrate it runs on, and that this substrate is largely missing.

I identify three layers that must exist below the agent: a memory substrate with provenance and conflict semantics, an authorization layer that issues verifiable, capability-scoped, holder-bound grants, and an observability layer whose unit of analysis is the decision rather than the span. I describe the design of four systems built to probe these layers — MemKit, Agent Guard, Agentic Fabric, and Vigilo — state the hypotheses each is testing, and report what has and has not yet been measured.

Behavioural controls ask the model not to do the wrong thing. Structural controls make the wrong thing unrepresentable. The distinction matters because behavioural controls degrade under exactly the conditions where they are most needed: novel inputs, long horizons, adversarial framing, and tool outputs that were themselves generated by an untrusted party.

Prompt-level guardrails and pattern matching are the most common controls in production today, and both fail structurally. A denylist of dangerous shell fragments is a statement about strings, not about effects; an agent that can reach a credential can exfiltrate it in an encoding nobody enumerated. The correct question is not 'did the agent try something that looked dangerous' but 'was the agent ever holding a credential that could do this at all'.

This reframing has a practical consequence: safety work moves out of the prompt and into the interfaces. What an agent can do becomes a property of the token it holds, the memory it can write, and the trace it must emit — none of which the model can talk its way past.

Most agent memory today is a vector index over past text. Retrieval returns the nearest neighbours of the current query and the model is left to reconcile them. This conflates two distinct operations: finding candidate context, and deciding what is currently true.

A memory substrate should treat facts as first-class records with provenance, time validity, confidence, and an explicit conflict policy. When two records disagree, the resolution must be a decision the system makes and records — recency, source authority, corroboration, or escalation — not an accident of cosine distance. Retrieval then returns not a bag of passages but a reconciled view plus the reasoning that produced it.

MemKit is the concrete probe for this. It classifies every write against what's already known -- add, update, or duplicate -- before it's stored, and exposes conflicts as an explicit archived-vs-active state rather than silently averaging them. Today it is a single flat store with lexical, not embedding-based, retrieval; the semantic-search layer is deliberately not yet built, because the conflict-classification problem came first. The hypothesis under test is that explicit write-time conflict resolution reduces contradiction-induced errors on long-horizon tasks, and the trade-off being measured honestly is write-path cost: classification is more expensive per write than a bare insert.

Ambient credentials are the root cause of most agent incidents worth reporting. An agent inherits a broad role, a tool call is influenced by untrusted content, and the blast radius is the union of everything that role could ever touch.

The alternative is a grant: a short-lived, narrowly scoped, holder-bound statement of a single intended effect, verifiable offline by the resource that will execute it. Holder-binding matters because a bearer token that leaks is a token that works; a grant bound to a key the holder must prove possession of is useless once copied. Scope matters because an effect-level grant ('write this object in this bucket, once, within 60 seconds') cannot be repurposed the way a role can.

Agent Guard implements this as the authorization layer for agent actions: the caller requests a capability describing an effect, the issuer decides, and the executing resource verifies asymmetrically without calling home. Enforcement lives at the boundary — hooks in the runtime, not instructions in the prompt — so an agent that has been talked into asking for more simply gets a grant it cannot use.

Metrics, logs, and traces were designed for human operators debugging deterministic services. They answer what happened, where, and how long it took. For an autonomous system the load-bearing question is different: why did this action look correct to the agent at the time?

That requires a reasoning trace — a structured record of the observations available, the alternatives considered, the grant requested, and the justification given — organised around episodes and decisions rather than services and spans. Once decisions are first-class records, two things become possible that are impossible with spans alone: replay, where the same situation is re-presented to a changed policy, and comparison, where two policies are scored against the same recorded situations.

Vigilo is the probe here. It watches file, process, and network signals directly and exposes them over MCP as decision-relevant events rather than raw log lines, with a fast per-event alert path and a slower correlating pass that re-indexes activity by episode rather than by host or span. The claim being tested is narrow and falsifiable: episode-indexed correlation catches multi-step attack chains that per-event rules structurally cannot, at an alert volume an operator will actually keep reading.

Multi-step agents fail in a characteristic way: a step half-succeeds, the summary reports success, and every downstream step reasons over a fiction. No amount of retry logic fixes this, because the retry is triggered by the same optimistic report.

Agentic Fabric treats step outcomes as claims that must be checked by something other than the model that made them. Enforcement runs as hooks around each step; verification prefers cheap external evidence — exit codes, resource state, a second model with no stake in the answer — over self-report. The design goal is that the orchestration layer, not the policy, is responsible for the invariant that recorded state matches real state.

This is where memory, authorization, and observability meet. A verified step outcome is a fact worth writing to memory with provenance. A step that needs a new effect requests a new grant. A step that failed is a decision record worth replaying. The layers are separable in implementation but not in value.

Each hypothesis above is stated so that it can be wrong. The evaluation design follows the same discipline: fixed workloads, named baselines, and metrics chosen before results are known.

For memory, the workload is long-horizon tasks containing planted contradictions, the baseline is a standard vector store with top-k retrieval, and the metrics are contradiction-induced error rate, retrieval precision, and added latency. For authorization, the workload is a corpus of injection and confused-deputy scenarios, the baseline is role-based access with prompt guardrails, and the metric is the fraction of scenarios where the harmful effect was structurally impossible rather than merely refused. For observability, the workload is recorded incidents and the metric is time-to-localisation.

Where results do not yet exist, this site says so. None of the three evaluations above has run yet — memory, authorization, and observability are all in progress, not preliminary. Publishing the methodology before the numbers is deliberate — it is the part that constrains me later.

Several problems in this space look genuinely unsolved rather than merely unbuilt, and they are the questions I want to spend the next several years on.

The agentic systems that end up trusted with production infrastructure will not be the ones with the most persuasive policies. They will be the ones whose substrate makes catastrophic actions structurally unavailable, whose memory can be interrogated, and whose decisions can be replayed against a changed policy.

That substrate is an infrastructure and systems problem with a research core: it needs formal statements of what a grant guarantees, principled semantics for memory conflict and deletion, and benchmarks that measure structural containment rather than behavioural compliance. The four systems described here are early, partial, and deliberately narrow — instruments for asking those questions rather than products claiming to answer them.