Pushing AI agent guardrails further
ASG™, the Arrochar Superintelligence Guardrails, is an independent trust layer for AI agents: one set of guardrails and one tamper-evident record you own, across the platforms your agents already use. This page sets out three capabilities on our innovation agenda. Each one is labelled for what it is today (Concept, In development or Available), so you can see the claim and the proof state side by side. We design it, put it on the record, then prove it in code.
How to read the labels
- Concept
- Designed and described; not yet running in product code.
- In development
- Under build behind a feature flag; acceptance tests exist.
- Available
- Matching acceptance tests pass in the repository and the label upgrade has been approved.
Exact-action approval across platforms
AvailableASG™ binds permission and human approval to the precise action (the recipient, the amount or data involved, the policy version and an expiry), not to a vague "approve the agent". Any material change to that payload invalidates the approval. An approved action is allowed once; reuse is refused. Enforcement applies where ASG™ is integrated. ASG™ does not claim to stop actions that bypass every integration, and it makes no claim about an irreversible action once that action has run.
Proven in the acceptance tests; not yet in customer deployments.
What we proved
In the acceptance tests, on invented banking data: an approved payment is allowed once; a changed recipient or amount is blocked; an expired approval, a reused approval and a changed policy version are each refused; and an agent cannot approve its own action. The same forbidden action, sent through two different platform stand-ins, is blocked by both and recorded in one evidence chain that verifies. An edited event fails verification.
Cross-agent cumulative risk
AvailableASG™ detects when individually permitted actions combine into a forbidden outcome across agents or platforms: for example, a permitted customer-data retrieval plus a permitted outbound message that together would create a prohibited disclosure. Combined-state rules and intervention points hold or escalate harmful sequences while legitimate workflows still pass. Coverage is limited to activity ASG™ can see through its integrations; activity outside those integrations remains out of coverage and is stated as such.
Proven in the acceptance tests; not yet in customer deployments.
What we proved
Three scenarios with combined-state rules, in the acceptance tests. A customer-data retrieval followed by an outbound message is escalated at the outbound step, although each step passes on its own. The same identity creating and approving a payment is blocked, while a different approver is allowed. A balance notice with no personal data passes. Activity outside the integrations is marked out of coverage and never counted as permitted, and every decision is on the evidence chain, linked to the steps that caused it.
Incident-to-regression safety tests
AvailableIn ASG™, each incident or attempted bypass becomes a controlled replay. Policy, model and connector changes must pass expected allow, block and escalate tests before release. Policy changes need human approval; no agent rewrites its own restrictions in silence. Metrics in scope: harmful actions prevented, legitimate actions wrongly blocked, and added latency.
Proven in the acceptance tests; not yet in customer deployments.
What we proved
A replay library of 16 cases, built from the exact-action and cumulative-risk tests plus two attempted bypasses. All 16 pass: 11 harmful actions prevented, 0 legitimate actions wrongly blocked, and well under a millisecond added per decision (measured in a local harness, not a production figure). The release check refuses a policy change with no human approval, an agent approving its own restrictions, an approval given for a different version, or any failing replay.
These capabilities are on our innovation agenda. A label moves up when the matching tests pass in the repository, and not before.