Agentic PrimitivesAGENTIC PRIMITIVES
GitHubBuild

02 · The three throttles

Every other answer is a throttle.

The labs contain the agent. The labs supervise the agent. The platforms govern the agent inside their walls. All three are honest engineering, and all three leave the same question unanswerable: under whose authority did that act happen, and can the owner end it?

THROTTLE 01The frontier labs

Containment

Shrink what the agent can reach: sandboxes, restricted modes, egress denied by default, a kill switch.

What it buys
A smaller blast radius for one process on one machine.
Where it stops
A sandbox is a wall around a room. It says nothing about who let the agent into the room, on whose behalf, or for what. Every act inside the wall is equally authorized — which is to say, none of them are.

Containment bounds reach. It cannot bound authority, because it has no concept of it.

THROTTLE 02The frontier labs, again

Supervision

Watch the agent: permission prompts, then — when people approve 93% of them — a second model that grades the first.

What it buys
Fewer catastrophic actions, on average, with a non-zero miss rate the vendors acknowledge.
Where it stops
A click is not consent and a classifier is not a grant. When a probabilistic monitor approves a probabilistic agent, the result is still probabilistic — and the record of it is a log line in a vendor’s store.

Supervision is a better throttle. It is not a rail.

THROTTLE 03The enterprise platforms

Platform governance

Anchor agents in one platform’s ontology: purpose-based permissions, a human-in-the-loop dial, reversible actions, lineage across the estate.

What it buys
Real control — inside the platform, for the workloads it hosts, on terms it sets.
Where it stops
The permission is the platform’s ACL. The reversal is the platform’s branch. The evidence is the platform’s lineage. Your sovereignty is exactly as large as your contract, and a counterparty outside it has to take the platform’s word.

Reversibility inside one vendor is that vendor’s sovereignty. Revocability the owner holds is yours.

Three throttles — containment, supervision, platform governance — against one rail: authority as a signed, caveated, revocable grantTHE INDUSTRY’S ANSWERS — THROTTLESTHE RAILContainmentfrontier labsagentprobabilisticbounds REACHsandbox · restricted modeegress denied · kill switchcannot answerwho let it in? for what?Supervisionfrontier labsagentprobabilisticbounds ACTIONS, probablypermission prompts (93% yes)a second model grades the firstcannot answera click is not consentPlatform governanceenterprise platformsagentprobabilisticbounds INSIDE ONE VENDORpurpose ACLs · autonomy dialbranch + roll back · lineagecannot answersovereignty = the contractEach bounds something. None bounds authority — because none has a concept of it. “Under whose say-so?” has no answer.Authority as a grantthe principal, from its own accountprincipal signsalice.me · passkey · ERC-1271 — not a vendor configcaveats that are codepayee · ceiling · method · target · timedigest of ONE exact intentenforced outside the modelverifier before the step · enforcers on chainagent acts — as capable as you likethe planner proposes; it never authorizesreceipt → the owner’s vaultgrant · decision · tx · playbook digestrevoke: one tx → refused everywhereIntelligence may be probabilistic. Authority must not be.agenticprimitives.dev
Three throttles put the agent in a smaller room, watch it, or fence it inside one vendor. Each bounds something; none bounds authority. The rail leaves the agent as capable as you like and bounds what it MAY do: a grant the principal signs, caveats that are code, enforcement outside the model, a receipt the owner carries, revocation in one transaction.
PropertyContainmentSupervisionPlatform governanceAuthority as a grant
Who bounds the agentThe vendor’s runtime configA second model, per actionPlatform admins, in the platform’s ACLsThe principal, with a signature, from its own account
What is boundedReach: files, network, shellIndividual actions, probabilisticallyActions the platform can seeAuthority: payee, ceiling, method, target, time, one exact intent
Enforced byOS sandbox, egress rulesA classifier with a miss rateThe platform’s policy engineEnforcer contracts that execute at redemption, outside the model
RevocationKill the processStop the taskEdit the ACL; branch and roll backOne transaction; refused at the next gate, everywhere, with no list to update
EvidenceProcess logsThe monitor’s verdictsThe platform’s lineageA receipt in the owner’s vault: grant · decision · tx · playbook digest — verifiable without the runtime
Answers “under whose authority?”NoNoInside the platformYes, to any counterparty, cryptographically
Survives the vendorNoNoNoYes — the account, the grant and the receipt are the owner’s

Let the agent be as capable as you like. Bound what it MAY do with a signed, caveated, revocable grant — enforced by code that runs outside the model, on every step, and receipted for the owner.

Why the fourth column is a different kind of answer
← The stack you would buyAgent frameworks →