Email and publishing
Configured-deployment example: the agent may draft while a broker owns the send credential and can withhold delivery before an external service accepts it.
S-01
Action security
Stop the effect—not merely the sentence.
Chatbots talk. Agents act - send, spend, publish, change. Guth is the checkpoint an action has to pass before it becomes real. Guth security is designed around the moment an AI system tries to do something consequential: send, publish, spend, deploy, unlock, move, or change.
Enforcement architectureThe agent proposes.
The agent proposes.
The gateway decides whether the action is allowed to exist.
A content filter can object to bad words. An action gateway sits in the execution path and can withhold the credential, capability, or physical enable signal required to make an effect real.
- 01
Propose
Target design: the agent must state exactly what it wants to do: the action, the target, the data, the tool, and the authority it claims to have.
- 02
Inspect
Target design: the gateway evaluates policy, current state, scope, recipient, credentials, limits, and required approvals.
- 03
Authorize
Target design: low-risk effects may proceed under policy; sensitive effects require a short-lived human or device-bound approval.
- 04
Commit or cut
Target design: the gateway issues a bounded capability token—or denies, holds, revokes, terminates, and records the attempt.
Circuit-breaker examples
Cut access at the boundary the engine actually controls.
Code and infrastructure
Configured-deployment example: execution stays inside a governed sandbox whose control plane can terminate the process, revoke its lease, or remove access.
Machines and physical systems
Design requirement: commands use signed, bounded authorization, while a watchdog, safety controller, or hardware interlock—not the language model—owns the final stop path.
Defense in depth
Precautions in the room, in the network, and in the engine.
Physical precautions
Device-bound approval, handwritten or captured signatures, printable records, unique seals, controlled workstations, and an independent manual cutoff.
Digital precautions
Encrypted transfer, credential vaults, brokered APIs, least privilege, short leases, recipient and data classification, immutable event records, and replay controls.
Engine enforcement
Structured action proposals, deterministic policy gates, bounded capability tokens, pre-commit checks, continuous watchdogs, and deny / hold / terminate states.
Design requirement
A signature should authorize one exact action—not become a reusable picture.
The current local surface captures signature strokes only. It does not yet bind a verified signer, device, payload hash, time window, authority policy, or receipt. Those controls must exist before Guth can describe a signature as authorization or issuance.
LOCAL STROKE-CAPTURE SPECIMENNo payload binding · no identity proof · no issuanceFuture target: exact frozen bytes + verified signer + device + expiry + decision receiptOpen the certificate test vector →
Approval path
One email. One exact approval. One receipt.
The useful security boundary is not a vague promise that an agent will behave. It is a control point that can freeze the exact proposed effect, ask the right human, and withhold the credential until the decision is valid.
- 01
Freeze the draft
Commit the exact recipient, subject, body, attachments, and source version.
sha256 5f2a…90bd - 02
Ask the named signer
Approval is bound to these bytes and this action. A reusable signature image is not authority.
decision PENDING - 03
Issue a short lease
The gateway may release one narrowly scoped capability for the approved recipient and payload.
send capability WITHHELD - 04
Record the outcome
The receipt says delivered, rejected, expired, or withheld only after the relevant system proves it.
external effects 0
The words matter
Audit, verification, certification, and security are related—not interchangeable.
- Audit
- A scoped engagement that tests a system and records what failed.
- Verification
- A check that a particular claim, result, receipt, identity, or seal resolves correctly.
- Certification
- A bounded conclusion for a named version and scope after its requirements are met. Guth does not currently claim accredited certification.
- Security
- The controls that restrict access, authorize effects, interrupt execution, and preserve evidence.
The engine can stop only actions routed through a control point it owns. Once an email has been accepted by an external server, code has escaped the sandbox, or a machine accepts unauthenticated commands, reliable prevention is already lost. Guth therefore treats brokered credentials, constrained effectors, and independent fail-safe controls as design requirements—not optional monitoring.