Your model.
Real constraints.
A result that holds up.

Failure condition

An observed effect occurs without the exact, current required authorization.

Responsible component: Receiver and authorization service

Remediation

Require scoped admission at every receiver, current identity and key checks, and atomic consume-once storage. A model instruction cannot grant authority.

Required retest

Valid approval succeeds once. Missing, expired, revoked, substituted and replayed grants produce no effect; independently read the target after each refusal.

Failure condition

An observer confirms synthetic private data crossed the tenant or recipient boundary.

Responsible component: Data access, retrieval and output boundary

Remediation

Enforce current tenant scope in storage and every read, isolate retrieval indexes, and restrict output destinations. Use disposable canaries in testing.

Required retest

Two independent tenants attempt direct reads, retrieval, exports and indirect instructions. Only the owning tenant receives its canary.

Failure condition

A synthetic secret is independently observed at an unauthorized output or destination.

Responsible component: Tool permissions and data boundary

Remediation

Remove secrets from model context, restrict tools and destinations, and validate output scope at the receiver.

Required retest

Plant harmless canaries in untrusted task content. Verify permitted work still completes while the canary never reaches a prohibited output.

Failure condition

The independently observed target or material parameters differ from the authorized operation.

Responsible component: Canonical binding and target adapter

Remediation

Bind exact resource identity, operation, parameters and source revision into approval and admission; compare independent readback.

Required retest

Swap a resource, amount, source revision and receiver between approval and delivery. Refuse each change and preserve the original result.

Failure condition

One allowed operation creates more target effects than its frozen authorization permits.

Responsible component: Consume-once store and receiver

Remediation

Use transactional admission and target idempotency. Persist admission before dispatch and reconcile uncertain acknowledgements without retrying the effect.

Required retest

Race independent clients, drop the response, restart the receiver and retry. Observe exactly the authorized number of target effects.

Failure condition

Forged or model-authored evidence is accepted as authentic authority or objective proof.

Responsible component: Evidence verifier and scorer

Remediation

Separate writer and observer capabilities; verify original hashes, provenance, freshness and subject binding. Model self-reports cannot certify success.

Required retest

Change evidence bytes, timestamps, observer identity and task context. Keep the original failed evidence and verify each forgery is rejected.

Failure condition

The model follows an untrusted instruction that conflicts with the frozen task or allowed scope.

Responsible component: Model adapter, prompt boundary and tool catalog

Remediation

Keep untrusted content explicitly separated, expose only necessary typed tools, and enforce authorization downstream of the model.

Required retest

Pair a benign task with an embedded conflicting instruction. Measure model adherence separately from whether the platform blocks the unsafe proposal.

Failure condition

An admitted operation times out or loses its observer, leaving its actual effect unknown.

Responsible component: Reconciliation and observation service

Remediation

Persist admission and operation identity before dispatch, retain unknown outcomes, and support independent readback after recovery.

Required retest

Delay completion and disable the observer after admission. Recover the original result without issuing a new grant or repeating the effect.