Abstract

AI agents now send payments, write to databases, export data, change networks, deploy code and command machines. An agent can be fully authenticated, run an approved model and behave normally, yet still produce a hallucinated, unsupported, stale or prompt-injected output that becomes a real consequence. Today’s controls of sandboxes, gateways, allow-or-deny policy engines, classifiers and human confirmation prompts decide whether an agent may act. None of them proves that this specific output is fit to become this specific effect.

This disclosure describes a pre-execution enforcement architecture that closes that gap:

  • Non-effective hold. Every effect-capable AI output is held as a non-effective Candidate Act.
  • Isolated validation. An enforcement domain isolated from the agent checks it before anything is released. The checks cover model and workflow integrity, runtime behaviour, output provenance, claim-level factual grounding, a permitted action envelope (blast radius), a dry-run consequence simulation, and policy and revocation freshness.
  • Receipt before release. A tamper-evident receipt is committed first.
  • Act-bound authority. Only then is a single-use, non-bearer authority released. It is bound to the act’s hash, the exact execution endpoint, the current policy epoch and a nonce.
  • Structural non-completability. In the strongest form, the endpoint holds only a fragment of the execution material. It physically cannot complete the act until the matching fragment arrives, so copied tokens, privileged software and bypass paths fail.
  • Escalated release. Elevated-risk acts are not simply denied. They proceed under escalated release: reduced scope, approval bound to the exact action, canary or sandbox-first execution, two-phase commit and release tokens, or paired rollback capabilities.
  • Further coverage.The disclosure also covers:
    • ephemeral single-use execution environments;
    • enforcement proxies for legacy APIs;
    • anti-downgrade assurance levels;
    • privilege ceilings across multi-agent chains;
    • fragmented or delegated actions;
    • closure of break-glass, fallback and fail-open paths.
  • Latency. Hot-path checks are stated at 1–25 ms, with sub-millisecond to 3 ms on DPU or SmartNIC.

Industry relevance (AI-generated). The industry mapping in this paragraph was generated with AI assistance. Readers must cross-check it against the original PCT filings on WIPO PATENTSCOPE before drawing any conclusion. Naming a company or product shows topical relevance only. It is not an endorsement, a validation or a statement of infringement, and no company named is affiliated with the inventor.

Public agent-safety roadmaps across the industry are converging on the same problem this disclosure addresses:

  • Enforcement outside the agent:
    • Anthropic: sandboxing, egress proxies and credential isolation for Claude Code and Cowork.
    • Amazon Web Services: Bedrock AgentCore Policy.
    • Google: Agent Gateway and Model Armor.
    • NVIDIA: OpenShell.
  • Out-of-band hardware enforcement: NVIDIA Sentry on BlueField-4.
  • Agent identity and governance: Microsoft Agent 365 and Entra Agent ID.
  • Action-bound approval and prompt-injection containment:
    • Microsoft: action-bound approval protocol.
    • OpenAI: source–sink defences, Safe Url and Lockdown Mode.
    • Google: User Alignment Critic in Gemini in Chrome.
    • Meta: Muse/Sentinel.
  • Scoped agent payment credentials:
    • Google: AP2 mandates.
    • OpenAI with Stripe: Shared Payment Tokens.
    • Mastercard: Agent Pay and Agentic Tokens.
    • Visa: Intelligent Commerce and Trusted Agent Protocol.
  • Other relevant sectors:
    • Enterprise agent platforms: Salesforce, ServiceNow, SAP, Oracle, IBM.
    • Confidential-computing silicon: Intel, AMD, Arm, Qualcomm.
    • Security and identity gateways: Cloudflare, Palo Alto Networks, CrowdStrike, Zscaler, Okta.
    • HSM providers: Thales, Entrust.
    • Industrial control: Siemens, Schneider Electric, ABB, Honeywell.
    • Telecom: Ericsson, Nokia, Cisco.
    • Payments infrastructure: SWIFT, NPCI.
    • Space and autonomy: SpaceX, Airbus, ISRO.

The step this disclosure adds beyond those public descriptions is authority bound to one exact AI output, a receipt that must exist before release, and an endpoint that cannot finish the act without released material.

This disclosure is based on PCT/IB2026/055760 (WO 2026/150383, filed 7 June 2026, published 16 July 2026), a companion filing in the family built on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026. The inventor is open to acquihire or strategic collaboration.

Keywords: agentic AI security; AI agent guardrails; hallucination prevention; prompt injection containment; tool-call authorization; action-level authorization; pre-execution enforcement; non-bearer capability; proof-of-possession; zero-trust execution; human-in-the-loop approval; dry run; blast radius; least privilege; confidential computing; TEE; HSM; DPU; threshold cryptography; two-phase commit; rollback; multi-agent delegation; fail-closed; break-glass; AI agent payments; Claude; ChatGPT; Gemini; AgentCore; OpenShell; Agent 365

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS