Rules tier · in build
Bounded Command and Action Governance expresses your tool registry as a closed vocabulary. The agent can choose among approved commands, and nothing else can be emitted: an injected or hallucinated command never reaches an action because it was never in the set the agent can produce.
What it does
Allow-lists, approval steps and a person in the loop are the right controls, and most of the time they hold. They share one assumption: that a disallowed command is noticed in time. At machine speed, "noticed" is the weak word.
A request framed to trigger a forbidden action cannot commit it, however it is worded.
A tool or command that is not in the registry cannot be produced.
Persuasion changes what the agent wants to do, not what it is able to emit.
How it works
Agent
Planning, tool choice and arguments, generated by the model.
Boundary
The registry, compiled to an automaton, admits only approved commands and typed arguments.
Action
Only an in-set command reaches the system; the rest cannot be emitted.
A change to the approved set is a tracked, reviewable event with its own version.
It composes with agent frameworks and tool runtimes rather than replacing them.
The automaton is pointed at your tool registry instead of a data schema.
Who it is for
Regulated entities
An agent that can approve, refer or decline a claim or a loan, move money, or change a customer record. Its action space has a provable ceiling: approve, refer, decline, and nothing else.
Operators
An autonomous haul truck, a drill or a process controller taking AI instructions. The closed set is proceed, slow, hold, or hand to the operator.
What it does not do
Whether an approved action is appropriate in context is a semantic question. That is Attested Semantic Compare.
Values are governed as tightly as the grammar types them, and no further.
An adversary with privileged access to the enforcement host is the reason the hardware appliance exists. For safety-critical actuation, start there.
Evidence rung it fills
That a forbidden action could not be taken.
Bounded Command delivers this inside the software trust boundary. The rules appliance carries the same closed vocabulary into hardware no software can bypass, with a prototype planned by mid-2027. With the Certifiable Conformance Pack, every admitted action also leaves a record.
Get in touch
Thirty minutes on where your AI acts, what evidence it would need to leave, and whether this is the right rung.
Book a 30-minute conversation →