The agent floor
The floor an AI agent is held to — by the kernel, not by its good behaviour.
An AI agent is a program like any other, and here it runs inside the same walls as everything else: exactly what its declaration grants, held there by the kernel, the core of the operating system that decides what every program may do. That single fact is what makes a genuinely governed agent possible — not a guardrail bolted on after the model, but the design of the floor beneath it: the operating system itself.
Give an agent real power inside its walls, and let the kernel hold the walls: what its file did not ask for, it does not get. What the machine does today, and what it does not do yet:
Only what it was granted
A program that did not ask for the network runs with none at all: the kernel gives it an empty one. It sees only the disks it asked for, and it cannot start another program unless its file says it may. There is no shell to break out to, because there is no shell.
Never past its budget
Memory and processor time are capped per program by the kernel. Past its memory, a runaway agent is stopped; past its share of the processor, it waits. The rest of the machine never feels it.
No route out
Declare a network with EGRESS none and the kernel has no directions to anywhere beyond it — and every boot says so. The model runs here, and the box knows no way to send the data elsewhere. A firewall that also stops a program looking for a way is not built yet.
A change goes through a check and a trial
The machine is a file in a small, strict language, which an agent can write as well as a person can. harb check judges the draft before anything runs, a person approves it, and the box tries it once and goes back if its boot does not match. The check and the trial are built; the tools for the agent's side are not yet.
Every boot is signed
The machine signs a record of each boot: which file it ran, and whether the boot matched it. Anyone holding its public key can check that no record was changed. What an agent does inside its walls is that program's record to keep — the machine signs what the machine was.
Not built yet, said plainly
A firewall. A signed record of each action an agent takes. The tools for an agent to propose a change and a person to approve it. And rehearsing an action first on Softanza's virtual twin, a model of the system that cannot touch the real one.
An agent proposes a change — and harb check judges it before anything happens
# 1 · the agent drafts a new service DEFINE SERVICE alerts AS ( RUN ["/app/alerts"], NEEDS [network] ) RATIONALE "watch, and warn" # 2 · harb check judges the draft — and refuses it alerts needs network, which no declaration grants → refused # 3 · the agent revises; a person approves the file + DEFINE CAPABILITY network ... (a human approves) # 4 · the box tries it once, then decides for itself boot: slot B -- a trial (committed is A) boot: judge -- the boot matches its expectation ... boot: slot B -- committed: ...
The same walls, read as security rather than as an agent's floor: Security — and, threat by threat, the ten agent threats.