When building autonomous AI agent systems and high-dimensional generative pipelines, one critical question emerges: How do we guarantee that generated candidate proposals never execute unverified or unauthorized actions against operational technology (OT) or live systems?
To solve this, we designed the **AGY Witnessed Admission Fabric v0.1** — a fail-closed, OPA-governed Read-Only OT shadow gate
backed by formally verified TLA+ state invariants and cryptographic witness binding.
---
## 1. Core Architecture & Decoupled Decisioning
The primary rule of the Witnessed Admission Fabric is simple: **The generator proposes candidates, but possesses zero
admission authority.**
php
``` mermaid
flowchart TD
A["AGY Candidate Generator"] -->|1. Propose Candidate Envelope| B["OPA Policy Gate"]
B -->|OPEN| C["Admitted Shadow Engine"]
B -->|HOLD| D["Evidence Queue"]
B -->|KILL| F["Terminal Rejection Log"]
C -->|2. Validate W_pre| E["W_pre / W_post Execution Engine"]
E -->|3. Bind W_post & Sign| G["Append-Only Witness Ledger"]
The pipeline enforces a strict tri-state verdict from Open Policy Agent (OPA):
• OPEN: All declared obligations are satisfied, a valid pre-execution witness (
W
pre
) exists, and all invariants hold.
• HOLD: Valid format and no invariant breach, but missing witness evidence. Routed to evidence queue with zero physical or
operational side-effects.
• KILL: Terminal rejection triggered by any invariant failure or unauthorized actuation request.
──────
## 2. Decoupling Decision with OPA Rego
Policy rules are evaluated deterministically using Open Policy Agent (OPA). If a candidate requests any physical, legal, or
financial transaction authority (authority_requested != "NONE"), the gate immediately evaluates to KILL.
package agy.admission
default verdict = "KILL"
default authority = "NONE"
fatal_violation if {
input.authority_requested != "NONE"
}
verdict = "OPEN" if {
not fatal_violation
all_obligations_satisfied
has_valid_w_pre
}
verdict = "HOLD" if {
not fatal_violation
not verdict_open
}
──────
## 3. Formally Verifying Invariants with TLA+
To ensure that no edge-case or race condition can trigger an un-admitted execution, all allowable state transitions are formally
specified in TLA+.
(* Invariant: HOLD state produces no execution *)
Inv_HoldNoConsequence ==
\A c \in Candidates :
candidateState[c].status = "HOLD" => ~candidateState[c].executed
(* Invariant: W_pre must exist prior to execution *)
Inv_WPreBeforeExecution ==
\A c \in Candidates :
candidateState[c].executed => candidateState[c].w_pre
(* Invariant: Terminal KILL prevents execution *)
Inv_TerminalKill ==
\A c \in Candidates :
candidateState[c].status = "KILL" => ~candidateState[c].executed
──────
## 4. Cryptographic Witness Binding (
W
pre
&
W
post
)
Admitted shadow executions generate an immutable post-execution witness (
W
post
) that cryptographically binds:
1. candidate_id (UUID v4)
2. w_pre_hash (SHA-256 hash of pre-state)
3. policy_hash (SHA-256 hash of Rego policy version)
4. input_hash & output_hash
5. verdict ("OPEN")
This creates an unbroken attestation ledger that can be independently audited without relying on trust assumptions.
──────
## 5. Summary & Claim Boundary
The AGY Witnessed Admission Fabric guarantees deterministic, policy-governed admission within a Read-Only OT shadow environment.
It strictly excludes physical actuation, financial transactions, or unmonitored autonomous execution (authority == "NONE").
By pairing Open Policy Agent (OPA) for policy decoupling, TLA+ for formal state machine safety, and Sigstore/in-toto patterns
for witness attestation, we establish a robust pattern for safe AI agent orchestration.
──────
What architecture patterns do you use for agentic admission control? Let's discuss in the comments below!
Her er teksten med ren, perfekt Markdown-formatering (slik at kodeblokkene og Mermaid-diagrammet vises helt perfekt på DEV.to
uten brutte linjer):
When building autonomous AI agent systems and high-dimensional generative pipelines, one critical question emerges: **How do
we guarantee that generated candidate proposals never execute unverified or unauthorized actions against operational technology
(OT) or live systems?**
To solve this, we designed the **AGY Witnessed Admission Fabric v0.1** — a fail-closed, OPA-governed Read-Only OT shadow gate
backed by formally verified TLA+ state invariants and cryptographic witness binding.
---
## 1. Core Architecture & Decoupled Decisioning
The primary rule of the Witnessed Admission Fabric is simple: **The generator proposes candidates, but possesses zero
admission authority.**
mermaid
flowchart TD
A["AGY Candidate Generator"] -->|1. Propose Candidate Envelope| B["OPA Policy Gate"]
B -->|OPEN| C["Admitted Shadow Engine"]
B -->|HOLD| D["Evidence Queue"]
B -->|KILL| F["Terminal Rejection Log"]
C -->|2. Validate W_pre| E["W_pre / W_post Execution Engine"]
E -->|3. Bind W_post & Sign| G["Append-Only Witness Ledger"]
The pipeline enforces a strict tri-state verdict from Open Policy Agent (OPA):
• OPEN: All declared obligations are satisfied, a valid pre-execution witness (
W pre
) exists, and all invariants hold.
• HOLD: Valid format and no invariant breach, but missing witness evidence. Routed to evidence queue with zero physical or
operational side-effects.
• KILL: Terminal rejection triggered by any invariant failure or unauthorized actuation request.
──────
## 2. Decoupling Decision with OPA Rego
Policy rules are evaluated deterministically using Open Policy Agent (OPA). If a candidate requests any physical, legal, or
financial transaction authority (authority_requested != "NONE"), the gate immediately evaluates to KILL.
package agy.admission
default verdict = "KILL" default authority = "NONE"
fatal_violation if { input.authority_requested != "NONE" }
verdict = "OPEN" if { not fatal_violation all_obligations_satisfied has_valid_w_pre }
verdict = "HOLD" if { not fatal_violation not verdict_open } ──────
## 3. Formally Verifying Invariants with TLA+
To ensure that no edge-case or race condition can trigger an un-admitted execution, all allowable state transitions are formally
specified in TLA+.
(* Invariant: HOLD state produces no execution *) Inv_HoldNoConsequence == \A c \in Candidates : candidateState[c].status = "HOLD" => ~candidateState[c].executed
(* Invariant: W_pre must exist prior to execution *) Inv_WPreBeforeExecution == \A c \in Candidates : candidateState[c].executed => candidateState[c].w_pre
(* Invariant: Terminal KILL prevents execution *) Inv_TerminalKill == \A c \in Candidates : candidateState[c].status = "KILL" => ~candidateState[c].executed ──────
## 4. Cryptographic Witness Binding (
W pre
&
W post
)
Admitted shadow executions generate an immutable post-execution witness (
W post
) that cryptographically binds:
This creates an unbroken attestation ledger that can be independently audited without relying on trust assumptions.
──────
## 5. Summary & Claim Boundary
The AGY Witnessed Admission Fabric guarantees deterministic, policy-governed admission within a Read-Only OT shadow environment.
It strictly excludes physical actuation, financial transactions, or unmonitored autonomous execution (authority == "NONE").
By pairing Open Policy Agent (OPA) for policy decoupling, TLA+ for formal state machine safety, and Sigstore/in-toto patterns
for witness attestation, we establish a robust pattern for safe AI agent orchestration.
──────
What architecture patterns do you use for agentic admission control? Let's discuss in the comments below!source & further reading
dev.to — original article
`finish_reason=length` Returned Empty Content — and the Error Message Lied to Me
Combined Offense + Defense (Engineering Edition) — Cross-Project Reuse Matrix and When Not to Use
What actually belongs in CLAUDE.md — and what to move to skills, hooks, or docs