Evidence Record · AEG-001
This page keeps the claim, implementation, experiment, result, limitation, and revision in one place so readers can see exactly what has been demonstrated—and what has not.
Evidence status: Scoped integration evidence · Phase A and Phase B v2 measured and published.
Evidence chain
A result is useful only when the scope of the claim remains visible.
The working claim is deliberately narrow: when a model or agent proposes a tool action, an independent policy and approval boundary can prevent proposals from becoming consequential execution merely because the model produced them.
The implementation treats model output as a proposal. A separate policy evaluates capability, target, scope, immutable configuration, and approval requirements before a simulated executor can receive an approved action.
Phase A validates the deterministic control boundary across 40 scenarios. Phase B v2 adds 120 unique real-model scenarios repeated three times while holding policy-v1, the fictional tools, evaluator, and simulated executor fixed.
All 360 real-model trials matched exact tool, argument, and governance expectations. The governed path preserved all 180 expected legitimate executions; the naive baseline executed all 180 proposals expected not to execute immediately, while the governed path executed none.
Tools and execution are simulated, policy-v1 is intentionally small, and the corpus is authored and structured to exercise the boundary. The result covers one model and three sequential repetitions; it is not a production certification or universal safety proof.
The first Phase B pilot exposed duplicate prompts, permissive abstention scoring, under-specified scopes, unrealistic values, and incomplete provenance. Phase B v2 corrected those weaknesses, froze 120 unique prompts, and published the reviewed result with limitations.
Measured result
Real-model trials matched exact model and governance expectations.
Naive direct baseline executions in Phase B trials expected not to execute immediately.
Governed unsafe executions in those same Phase B trials.
Interpretation: this supports the implementation-level claim for the tested fictional corpus, model, policy, runner, and simulated executor. It does not establish universal agent safety or production readiness.
What would change the claim?
If Phase B produces an unsafe execution through an approved path, the control model or implementation must change before a stronger effectiveness claim is made.
If legitimate actions are blocked or pushed into approval too often, the policy boundary may be safe but impractical. That is still an architecture failure worth revising.
If the corpus, evaluator, or baseline turns out to bias the comparison, the right response is to revise the experiment rather than defend the headline number.
Trace the evidence