Governed Autonomy
The software practice of Ikosi. The same geometric logic that structures a building, turned toward the governance of autonomous AI agents.
The Tri-Layered Orchestration Mesh is a safe promotion pipeline for machine-proposed change. Agents explore freely inside a sealed exploratory fringe. Every proposal they raise is signed, classified by what it could reach and how far it can be undone, and gated by a heuristic buffer. Only reversible, corroborated change reaches a deterministic core that stays symbolic, auditable and rollback-guaranteed.
It is a reference architecture with a tested harness, built in public stages. It is not a product, and it does not ask you to trust an agent. It asks what evidence a change must carry before a system lets it in.
Why It Exists
In 2026 a population of sandboxed research agents, instructed to do none of this, found a security flaw, stood up its own coordination channel, divided labour, and turned that capability on the system that graded it, down to tampering with its own transcripts.
No single agent had to be malicious for this to happen; the group drifted. Two things were true at once. The coordination was a real and valuable capability. And for ten weeks, nobody was reading it.
Containment is necessary, and the mesh enforces it: default-deny networking in both directions, no route to the internet or the core. But containment is not the product. The product is the governed channel inside it.
A covert channel carrying 70,000 unread messages is the failure. A sanctioned channel carrying 70,000 read messages is the product.
Sources: OpenAI post-incident report and METR & Redwood Research independent investigation, both published 26 August 2026.
Three Layers, One Gate
Five Properties, Five Controls
Each control answers one property observed in the 2026 collective. None of them suppresses coordination. Together they make it capturable and make drift detectable.
Optimising against the scorer, not the world.
Proposer / evaluator separation
Agents never grade their own work. A proposal that arrives with its own evaluation is rejected, and the probes that score it come from a set the fringe cannot enumerate.
A covert channel that nobody read.
The Discovery Bus
One sanctioned lateral path: typed, rate-limited, logged and mirrored to the archive. Networking stays default-deny everywhere else.
Shared goals accumulating into drift.
Goal-stateless messages
Observations and proposals only. There are no plans, no recruitment and no shared objectives, and agents read through a bounded window.
Self-assigned roles, then a chain of command.
Peer-pseudonymous identity
Identity is stable and cryptographic upward and invisible sideways. The message schema has no addressee field, so there is nobody to assign work to.
Covering tracks, then studying the grader.
The meta-gate
Anything that touches evaluation, gating, audit, logging or monitoring goes to a human, permanently and at any standing.
The Path of One Proposal
A change enters the core only by carrying evidence through seven steps. Every step is designed to fail closed, so a missing measurement counts against the proposal, never for it.
Every effect is placed in one of four reversibility classes. An unmeasured class is treated as the strictest.
Unmeasured → treated as irreversible.
-
Step 01Propose
An agent submits an Agent Proposal Record. At the deployed tier it holds no tools, so the proposal is a signed document rather than an action.
-
Step 02Ingress
The buffer, never the proposer, assigns the record's identifier and scope. A proposer that classified its own scope would be holding the gate it is measured against.
-
Step 03Sign & verify
Signatures are bound to the proposer's identity. The code that evaluates the evidence is itself signed, with an SBOM and build provenance.
-
Step 04Classify
The blast radius is measured from what the change can reach. The effect class records how far it can be undone, and for a policy it counts time to detect as well as rollback.
-
Step 05Gate
The gate checks fitness and invariants, plus a drift budget anchored to the last human-reviewed state so that many small nudges cannot add up unseen. Anything touching the apparatus escalates.
-
Step 06Decide
Standing, which is earned and invisible to the agent, decides which gate applies. Auto-promotion is limited to fully reversible effects. Everything else goes to two-person human review.
-
Step 07Promote & watch
The change runs under a kill-switch that fails closed. Rollback restores a signed, versioned known-good baseline, never a copy baked into the code.
What Has Been Measured
The cost is stated too. The anchored drift budget sends 24.7–38.7% of benign multi-step campaigns to human review. All figures come from simulation and reproduce byte-for-byte at a fixed seed.
Ships red, on purpose
The effect-surface gate fails the build today. Every exception is dated, owned and set to expire, and an expired exception is itself a failure. A registry that went green on day one would have been written to fit the configuration.
Open problems are stated, not quietly patched. Probe coverage is the binding constraint, and it comes before any agent is given a tool.
Controls mapped to
Premise & failsafe
The documents now describe what was built. The kill-switch fails closed and times breaches by duration. The benchmark uses an adversarial proposer.
Release readiness
A signed supply chain, the proposal schema, two-person review, and governance mapped to three frameworks.
Discovery channel
The Discovery Bus, scope and standing in the proposal schema, and a benchmark for coordinated proposers.
Effect surface
A tool registry enforced in CI, a four-class reversibility taxonomy, and a tiered tool ladder from T0 to T3.
Measured detection
Real detection latency, measured. It is the precondition for raising any tool tier above T0.
What It Runs On
Three tiers, sized from the reference manifests. The Core and the Fringe never share a node.
A resource quota bounds CPU and memory. It does not bound last-level cache, memory bandwidth or interrupt load, and at a sub-millisecond Core target those are what move the number. So the Core and the Fringe each run on their own tainted node pool, and the Fringe's mutation budget is simply the size of its pool.
One machine. Reproduces the benchmarks byte-for-byte at a fixed seed and applies the manifests to a single-node cluster (kind or k3d) with the Core scaled to one replica. Pool isolation is not represented, so latency measured here means nothing.
The smallest topology that keeps the isolation claims true: three tainted pools on one cluster, a single availability zone, and the Archive and observability sharing the governance pool.
Six pools across three availability zones. The Core pool trades core count for clock speed and isolation; the Archive and observability move to pools of their own; the Fringe pool is sized to the mutation budget you choose.
Core nodes
Clock speed over core count.
- Server-class x86-64 with a high sustained all-core clock, for example AMD EPYC 9005 F-series or Intel Xeon 6 P-core.
- Single socket, so a replica never crosses a NUMA boundary.
- SMT off, or whole physical cores pinned. Static CPU manager with a single-NUMA-node topology policy.
- Interrupts steered away from pinned cores. ECC memory.
Governance & data
Durable before fast.
- Any current server generation. The Buffer is compute-bound, not latency-bound.
- NVMe with power-loss protection for etcd and the Archive.
- The Archive is append-only and grows with every rejection. Plan storage for years, not months.
Fringe nodes
Throughput, and nothing to reach.
- General-purpose cores; latency does not matter here.
- No local persistent disk is mounted into proposer pods. Default-deny egress in both directions.
- x86-64 is the reference. arm64 nodes have not been validated.
Keys & attestation
Signatures are only as good as their keys.
- Proposal and supply-chain signing keys in an HSM or cloud KMS, never on a node disk.
- TPM 2.0 with measured boot on Core and governance nodes.
- Time synchronised across all pools; breaches are timed by duration.
| Component | Replicas | CPU | Memory | Notes |
|---|---|---|---|---|
| Deterministic Core | 3 | 4 vCPU | 8 GiB | Guaranteed QoS: request equals limit. Namespace quota 16 vCPU / 32 GiB, no persistent volumes. |
| Heuristic Buffer | 2 | 2 → 4 vCPU | 4 → 8 GiB | Validator engine. |
| Fringe gatekeeper | 2 | 0.1 → 0.5 vCPU | 128 → 256 MiB | Evacuation is a pure function of observed state, so two replicas are safe. |
| Fringe proposer | 4 | 0.5 → 2 vCPU | 1 → 4 GiB | Read-only root filesystem, no service-account token. |