Ziffer
AGENT AUTHORITY / ONE

The model
proposes.
It never
authorises.

Why the safest agent is the one whose obedience does not matter, and how to build the layer that makes it so.

ZIFFER · AGENT AUTHORISATION01 / 09
ZifferTHE PROBLEM

A credential is
not authorisation.

Give an agent the keys and every document it reads holds the keys.

2.0%
OF ATTACKS SUCCEED
AGAINST THE BEST MODEL
EVER MEASURED · 15 TRIES
∞
ATTEMPTS AVAILABLE
TO THE ATTACKER
AT NO COST

A small chance per try becomes a certainty over enough tries.

THE SCORE IS A SNAPSHOT · THE EXPOSURE IS PERMANENT02 / 09
ZifferTHE LIMIT

No amount of testing
reaches zero.

0 failures in n tries
does not mean zero risk
it means up to about 3 in n, at 95% confidence

More testing shrinks that number. Nothing takes it to zero. That would mean proving how the model behaves on every input anyone could ever send it.

You do not reach zero by making the model better. You reach it by making the model's obedience irrelevant.

ESTIMATES FOR BEHAVIOUR · PROOFS FOR AUTHORISATION03 / 09
ZifferPRIOR ART

We have made
this move before.

SQLInjection did not die from better filtering. It died when databases learned to keep the user's text and the command apart, so text could never become a command.
DEPBuffer overflows receded when the memory holding incoming data was marked data only. Anything smuggled in there could not run.
ACPThe model's output is words, never permission. It fills in a request form. No keys, no tools, no route to any effect.

Stop trying to spot the bad input. Remove the path by which any input becomes permission.

DESIGNED OUT, NOT DETECTED04 / 09
ZifferTHE SHAPE

One pipeline,
two channels.

TEXT CHANNEL - WORDS ONLY, NOTHING HERE IS TRUSTED The model MAY BE FOOLED · WRONG · HIJACKED A written request ITS ONLY OUTPUT · NO POWER TO ACT Safe because it can do nothing, not because we screened it. ACTION CHANNEL - EVERYTHING THAT ACTUALLY HAPPENS PASSES HERE The rules are checked POLICY ENGINE · WORKS OUT THE RISK FROM A RULEBOOK THE AI CANNOT SEE People sign off APPROVERS · ON THIS EXACT REQUEST, WHERE THE RULEBOOK DEMANDS IT A separate key service KMS · VERIFIES THE RULEBOOK, THEN SIGNS THE RECEIPT: PROOF OF CHECKS Carries it out EXECUTOR · ONLY ON A VALID RECEIPT HOLDS NO SIGNING KEY OF ITS OWN DECISION SIGN-OFFS · CARRIED IN THE RECEIPT RECEIPT Effect LOGGED FIRST Nothing ON ANY FAILURE

Nothing in the text channel can be promoted. Words never become permission.

ONE PIPELINE · TWO CHANNELS OUT OF THE MODEL · NO THIRD ROUTE05 / 09
ZifferTHE PATH

One request,
end to end.

01The model fills in a request form. Assume it has already been fooled.
02The request is fingerprinted. That fingerprint is the only thing signed.
03It is checked against a rulebook signed with a key no machine holds.
04Anything that cannot be undone waits for people to sign that fingerprint.
05The part that acts re-checks every signature. It can sign nothing itself.
06The log entry is written before the action. Any failed check and nothing happens.

A completely fooled model produces a request that fails a signature check.

IF ANY CHECK FAILS, NOTHING HAPPENS · THAT IS THE DEFAULT06 / 09
ZifferTHE RULEBOOK

The attack surface
fits on one page.

No blocklist, no virus signatures. Write down the ten to thirty things the agent may do. Everything else cannot happen.

schedule_appointment → LOW, runs on its own
order_synthesis → HIGH, cannot be undone, 2 signatures
release_to_partner → HIGH, only its own project's data
anything_unlisted → refused before it is even scored

The signing key lives offline. Take over every running machine and you still cannot change a rule.

NOTHING IS ALLOWED UNLESS IT IS ON THE LIST07 / 09
ZifferWHERE IT BITES

Where a mistake
cannot be taken back.

The test is not the industry. It is whether the action can be taken back: the ones where a mistake cannot be undone.

DRUG DISCOVERYAn agent orders synthesis and a molecule becomes physical at a contract lab.
FINANCEA payment agent wires funds or creates a beneficiary. Money that has moved.
HEALTHCAREAn assistant releases patient records. Data that has left the building.
INDUSTRY · FLEETSTemperature setpoints, valves, updates sent to a whole fleet. Physical effects, at scale.
ENTERPRISE ITAccess grants and firewall rules, handed out through a chat window. The keys to everything else.

If everything your agent does can be undone, you may not need this. What is left is the market.

REVERSIBLE WORK RUNS FREE · THE GATE IS ONLY AT THESE DOORS08 / 09
ZifferTHE GUARANTEE

Break in anywhere.
It still holds.

Every way we could think of to break it was written down and tried. None worked. What the rules forbid is proved impossible, not tested and hoped. And take any single protection out of the code: the tests notice.

01Take over the model completely and it still holds. Nothing depends on it behaving.
02Take over any single service and it still holds. No one of them can fake the sign-offs.
03Steal the rulebook store and it still holds. Tampering breaks the signature.
04Re-use an old approval and it still holds. Every signature is spent once.

Not a lower failure rate. A different kind of guarantee.

ZIFFER.IO · ACP-SPEC-001 · DEPLOY IT WHERE A MISTAKE CANNOT BE TAKEN BACK09 / 09
← → · SWIPE