Mode B · Software tier
A closed-vocabulary automaton makes out-of-set commands unemittable, not filtered, not flagged, unemittable. No jailbreak reaches an action that was never in the accept-set.
You already gate what your agents can do, approval steps, allow-lists, a human in the loop. Those controls are right, and most of the time they hold. They share one assumption: that a disallowed command gets caught. At machine speed, "caught" is the weak word.
Why now
In November 2025, a state-sponsored group ran an autonomous AI agent through a full intrusion campaign against roughly thirty organisations, with an estimated 80% of the operation executed with no human in the loop. The software guardrails meant to contain it were bypassed at the speed the machine moved.
~80%
of the operation ran autonomously, with no human in the loop.
~30
organisations targeted in a single agent-driven campaign.
What it defeats, and what it doesn't
Defeats
The forbidden token cannot be committed, regardless of how the request was framed.
Doesn't
A permitted command used at a harmful moment, that is Mode A's job.
The mechanism is the same automaton described in Structured Output Assurance, pointed at your tool registry rather than a schema, we won't repeat the mechanics here.
In practice
The agent triggers real actions, and runs against a defined tool/command automaton. Injected or hallucinated commands cannot execute, not because they were caught, but because they were never in the accept-set the agent can emit from.
Expressing a tool registry as a closed vocabulary the agent can enumerate but not exceed.
Versioned vocabulary updates, so a change to the accept-set is a tracked, reviewable event.
Composing with agent frameworks and MCP-style tool runtimes rather than replacing them.
The honest boundary
Satisfies Rules 2 and 4 within the software trust boundary; Rules 1, 3 and 7 in full arrive at the hardware rung. The eight rules →