Abstract

In most AI-agent and automation stacks, one component decides and a downstream component simply trusts that decision. A policy engine, gateway, classifier, trusted execution environment or approval step says yes. The tool, MCP server, database, cloud API or payment rail then carries out whatever request arrives with that approval. This leaves several gaps:

  • the checker may be the same component that collected the inputs;
  • approvals, tokens and receipts can be replayed, widened, rerouted or used after policy has changed;
  • the operation that was checked can differ from the one actually committed, a time-of-check-to-time-of-use (TOCTOU) gap;
  • readable data, memories and retrieved documents can be indexed, embedded, exported, used for training or used to steer an agent without any explicit authorization for that use.

This disclosure describes a two-instance execution-control architecture that removes the single point of trust:

  • First check, at collection time. A first protected domain binds inputs, instructions, provenance, purpose, scope and permitted effect when the inputs arrive. An input integrity gateway seals provenance first, so poisoned inputs are refused binding.
  • Second, independent check, at execution time. A second protected domain validates the proposed action against that binding. It is independent through a separate hardware root, session, keys, runtime or administration. It produces evidence cross-committed to the binding, so neither artifact alone can authorize anything.
  • Release only on agreement. Only when both artifacts mutually corroborate is a single-use, non-bearer authority released.
  • The endpoint checks what is actually happening.At the execution boundary, the endpoint independently reconstructs the actual pending operation through its own attested observation channel. Endpoints include:
    • a tool dispatcher, MCP or connector gateway, or API gateway;
    • a database commit or cloud control plane;
    • network egress, a payment rail or an actuator.
  • Endpoint verification and commit. The endpoint checks the reconstructed operation against both artifacts and against its own state (nonce, counter, spent-capability, and its own policy and revocation epochs). It then commits the operation atomically, as exactly the operation it verified.
  • Contained compromise. A compromise of either domain, the transport channel or the compute plane is confined to its own window and cannot by itself make an unauthorized act effective. Mismatches fail closed and the artifacts are burned.
  • Next steps depend on proof. Evidence produced at the endpoint becomes a required input to the next tool call, delegation, memory update, retraining or settlement.
  • Shared, not central, authority. Distributed partial shares can replace any central authority, so no node, requester or model process ever holds a complete reusable authorization.

The 54 claims, 15 of them independent, cover:

  • AI-agent tool dispatch;
  • MCP and connector supply-chain substitution (manifest, schema, endpoint and permission drift);
  • computer-use and browser actions;
  • memory and retrieval-augmented generation (RAG) content that stays readable but operationally inert for unauthorized indexing, embedding, training or tool influence;
  • multi-agent delegation chains in which no sub-agent can widen, replay or self-execute authority;
  • autonomous cloud-control changes;
  • regulated AI output release;
  • coding and CI/CD agents (repository, diff, dependency, deployment and secret scope);
  • agent skills, plugins and marketplace extensions;
  • multimodal assistants;
  • real-time voice and meeting agents;
  • agentic purchasing with basket reconstruction before checkout;
  • persistent AI memory and profiles;
  • workspace, connector and scheduled agents.

Industry relevance (AI-generated). This section was generated with AI assistance and describes technical relevance only. Readers must cross-check it against the original PCT filing on WIPO PATENTSCOPE and official company sources before drawing any conclusion. Naming a company or product is not an endorsement, a validation, a criticism or a statement of infringement, and no company named is affiliated with the inventor. These are potential integration scenarios, not confirmed company implementations or product commitments.

The architecture could complement current agent-safety layers:

  • Anthropic: sandboxes, credential-isolating proxies, MCP and connectors, Agent Skills, Claude Code.
  • OpenAI: source–sink defences and confirmations, the Agents SDK sandbox and handoffs, Codex, ChatGPT agent and memory.
  • Google: the User Alignment Critic in Gemini in Chrome, Agent Gateway, Model Armor, Android AppFunctions.
  • Microsoft: Prompt Shields with Spotlighting, the Windows MCP proxy, Agent 365, Entra Agent ID, Copilot Studio.
  • AWS: Bedrock AgentCore Gateway.

In each case it would add an independent second check whose evidence must corroborate the first, plus endpoint-side reconstruction of the actual action.

It is also relevant to:

  • Vector databases and data platforms: Pinecone, Weaviate, MongoDB, Snowflake, Databricks.
  • Multi-agent frameworks: the Agent2Agent protocol, LangGraph, CrewAI, Microsoft Agent Framework.
  • Coding agents: GitHub Copilot coding agent, Google Jules, Cursor, GitLab Duo.
  • Cloud and infrastructure-as-code: AWS, Azure, Google Cloud, Terraform.
  • Agentic commerce: Stripe, Visa, Mastercard, PayPal, Shopify.
  • Workspace agents: Microsoft 365 Copilot, Google Workspace, Slack, Salesforce Agentforce, ServiceNow.
  • HSM and MPC custody: Thales, Entrust, Fireblocks.
  • Confidential computing: NVIDIA, Intel TDX, AMD SEV-SNP, Arm CCA, AWS Nitro.

In Europe, the mechanisms may support objectives associated with:

  • EU AI Act: record-keeping, human oversight, and robustness and cybersecurity (Articles 12, 14 and 15).
  • GDPR: purpose limitation and data protection by design.
  • DORA, NIS2 and the Cyber Resilience Act.

Technical alignment does not itself establish regulatory compliance.

This disclosure is based on PCT/IB2026/056941 (WO 2026/172336, filed 6 July 2026, published 20 August 2026; International Searching Authority ISA/IN). That filing builds on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026. The inventor is open to acquihire or strategic collaboration.

Keywords: AI safety; agentic AI safety; agentic AI security; separation of duties; dual control; two-person rule; independent verification; defence in depth; zero-trust execution; complete mediation; policy enforcement point; TOCTOU prevention; atomic commit; replay prevention; confused deputy; tool-call authorization; function-calling security; MCP security; Model Context Protocol; tool poisoning; rug-pull attack; connector manifest integrity; tool schema drift; computer-use agent security; browser agent security; coding agent security; CI/CD security; software supply-chain security; agent skills security; plugin marketplace security; RAG security; RAG poisoning; vector database security; memory poisoning; data usage control; purpose limitation; training-data admission control; multi-agent delegation; sub-agent permissions; Agent2Agent (A2A); cloud control-plane security; infrastructure-as-code guardrails; agentic commerce; agent payments; voice AI consent; non-bearer capability; proof-of-possession; single-use authorization; threshold authorization; secret sharing; multi-party authorization; remote attestation; measured boot; confidential computing; TEE; HSM; DPU; fail-closed; EU AI Act; GDPR; DORA; Claude; Claude Code; ChatGPT; Codex; Gemini; Agent Gateway; Copilot; Agent 365; AgentCore

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS