Project Guardian: A Hybrid Safety System for AI Agents

A developer working on FerrumDeck, an alpha control plane, described a hybrid safety design for AI agents in which runs requiring approval park in a WaitingApproval state and audit events are recorded in an append-only log with a per-tenant hash chain. The developer cautioned that the scheme is tamper-evident rather than tamper-proof and governs only its own runs, calling it a reference rather than a drop-in solution, and pointed to the paper "AI Control: Improving Safety Despite Intentional Subversion" (arXiv 2312.06942) for the threat model in which an agent tries to evade its monitor. The post closes by asking what the prototype agent will act on: files and shell, or API calls.

For the research side of the independent observation channel, I would start with “AI Control: Improving Safety Despite Intentional Subversion” arXiv 2312.06942 . It assumes the agent may be trying to get around the monitor, which is the same threat model as your level-two observer. On the practical side, one thing that helped me: make the record append-only and hash-chained, so a later step cannot quietly rewrite history. I work on FerrumDeck, an alpha control plane where a run that needs approval parks as WaitingApproval, and audit events are append-only with a per-tenant hash chain. That is tamper-evident, not tamper-proof, and it only governs its own runs, so treat it as a reference, not a drop-in. What will the agent act on in the prototype: files and shell, or API calls?