When Did AI Become the New Toy? I Just Got Here.

A developer designed the AGY Witnessed Admission Fabric v0.1, a fail-closed, OPA-governed Read-Only OT shadow gate that prevents AI agents from executing unverified actions. The system uses Open Policy Agent for policy decoupling, TLA+ for formal state machine safety, and cryptographic witness binding to ensure safe AI agent orchestration.

When building autonomous AI agent systems and high-dimensional generative pipelines, one critical question emerges: How do we guarantee that generated candidate proposals never execute unverified or unauthorized actions against operational technology OT or live systems? To solve this, we designed the AGY Witnessed Admission Fabric v0.1 — a fail-closed, OPA-governed Read-Only OT shadow gate backed by formally verified TLA+ state invariants and cryptographic witness binding. --- 1. Core Architecture & Decoupled Decisioning The primary rule of the Witnessed Admission Fabric is simple: The generator proposes candidates, but possesses zero admission authority. php mermaid flowchart TD A "AGY Candidate Generator" -- |1. Propose Candidate Envelope| B "OPA Policy Gate" B -- |OPEN| C "Admitted Shadow Engine" B -- |HOLD| D "Evidence Queue" B -- |KILL| F "Terminal Rejection Log" C -- |2. Validate W pre| E "W pre / W post Execution Engine" E -- |3. Bind W post & Sign| G "Append-Only Witness Ledger" The pipeline enforces a strict tri-state verdict from Open Policy Agent OPA : • OPEN: All declared obligations are satisfied, a valid pre-execution witness W pre exists, and all invariants hold. • HOLD: Valid format and no invariant breach, but missing witness evidence. Routed to evidence queue with zero physical or operational side-effects. • KILL: Terminal rejection triggered by any invariant failure or unauthorized actuation request. ────── 2. Decoupling Decision with OPA Rego Policy rules are evaluated deterministically using Open Policy Agent OPA . If a candidate requests any physical, legal, or financial transaction authority authority requested = "NONE" , the gate immediately evaluates to KILL. package agy.admission default verdict = "KILL" default authority = "NONE" Fatal Invariant Violations fatal violation if { input.authority requested = "NONE" } OPEN Verdict Prerequisite verdict = "OPEN" if { not fatal violation all obligations satisfied has valid w pre } HOLD Verdict for Incomplete Evidence verdict = "HOLD" if { not fatal violation not verdict open } ────── 3. Formally Verifying Invariants with TLA+ To ensure that no edge-case or race condition can trigger an un-admitted execution, all allowable state transitions are formally specified in TLA+. Invariant: HOLD state produces no execution Inv HoldNoConsequence == \A c \in Candidates : candidateState c .status = "HOLD" = ~candidateState c .executed Invariant: W pre must exist prior to execution Inv WPreBeforeExecution == \A c \in Candidates : candidateState c .executed = candidateState c .w pre Invariant: Terminal KILL prevents execution Inv TerminalKill == \A c \in Candidates : candidateState c .status = "KILL" = ~candidateState c .executed ────── 4. Cryptographic Witness Binding W pre & W post Admitted shadow executions generate an immutable post-execution witness W post that cryptographically binds: 1. candidate id UUID v4 2. w pre hash SHA-256 hash of pre-state 3. policy hash SHA-256 hash of Rego policy version 4. input hash & output hash 5. verdict "OPEN" This creates an unbroken attestation ledger that can be independently audited without relying on trust assumptions. ────── 5. Summary & Claim Boundary The AGY Witnessed Admission Fabric guarantees deterministic, policy-governed admission within a Read-Only OT shadow environment. It strictly excludes physical actuation, financial transactions, or unmonitored autonomous execution authority == "NONE" . By pairing Open Policy Agent OPA for policy decoupling, TLA+ for formal state machine safety, and Sigstore/in-toto patterns for witness attestation, we establish a robust pattern for safe AI agent orchestration. ────── What architecture patterns do you use for agentic admission control? Let's discuss in the comments below Her er teksten med ren, perfekt Markdown-formatering slik at kodeblokkene og Mermaid-diagrammet vises helt perfekt på DEV.to uten brutte linjer : When building autonomous AI agent systems and high-dimensional generative pipelines, one critical question emerges: How do we guarantee that generated candidate proposals never execute unverified or unauthorized actions against operational technology OT or live systems? To solve this, we designed the AGY Witnessed Admission Fabric v0.1 — a fail-closed, OPA-governed Read-Only OT shadow gate backed by formally verified TLA+ state invariants and cryptographic witness binding. --- 1. Core Architecture & Decoupled Decisioning The primary rule of the Witnessed Admission Fabric is simple: The generator proposes candidates, but possesses zero admission authority. mermaid flowchart TD A "AGY Candidate Generator" -- |1. Propose Candidate Envelope| B "OPA Policy Gate" B -- |OPEN| C "Admitted Shadow Engine" B -- |HOLD| D "Evidence Queue" B -- |KILL| F "Terminal Rejection Log" C -- |2. Validate W pre| E "W pre / W post Execution Engine" E -- |3. Bind W post & Sign| G "Append-Only Witness Ledger" The pipeline enforces a strict tri-state verdict from Open Policy Agent OPA : • OPEN: All declared obligations are satisfied, a valid pre-execution witness W pre exists, and all invariants hold. • HOLD: Valid format and no invariant breach, but missing witness evidence. Routed to evidence queue with zero physical or operational side-effects. • KILL: Terminal rejection triggered by any invariant failure or unauthorized actuation request. ────── 2. Decoupling Decision with OPA Rego Policy rules are evaluated deterministically using Open Policy Agent OPA . If a candidate requests any physical, legal, or financial transaction authority authority requested = "NONE" , the gate immediately evaluates to KILL. package agy.admission default verdict = "KILL" default authority = "NONE" Fatal Invariant Violations fatal violation if { input.authority requested = "NONE" } OPEN Verdict Prerequisite verdict = "OPEN" if { not fatal violation all obligations satisfied has valid w pre } HOLD Verdict for Incomplete Evidence verdict = "HOLD" if { not fatal violation not verdict open } ────── 3. Formally Verifying Invariants with TLA+ To ensure that no edge-case or race condition can trigger an un-admitted execution, all allowable state transitions are formally specified in TLA+. Invariant: HOLD state produces no execution Inv HoldNoConsequence == \A c \in Candidates : candidateState c .status = "HOLD" = ~candidateState c .executed Invariant: W pre must exist prior to execution Inv WPreBeforeExecution == \A c \in Candidates : candidateState c .executed = candidateState c .w pre Invariant: Terminal KILL prevents execution Inv TerminalKill == \A c \in Candidates : candidateState c .status = "KILL" = ~candidateState c .executed ────── 4. Cryptographic Witness Binding W pre & W post Admitted shadow executions generate an immutable post-execution witness W post that cryptographically binds: This creates an unbroken attestation ledger that can be independently audited without relying on trust assumptions. ────── 5. Summary & Claim Boundary The AGY Witnessed Admission Fabric guarantees deterministic, policy-governed admission within a Read-Only OT shadow environment. It strictly excludes physical actuation, financial transactions, or unmonitored autonomous execution authority == "NONE" . By pairing Open Policy Agent OPA for policy decoupling, TLA+ for formal state machine safety, and Sigstore/in-toto patterns for witness attestation, we establish a robust pattern for safe AI agent orchestration. ────── What architecture patterns do you use for agentic admission control? Let's discuss in the comments below