Safety Architecture
Defense-in-depth protection with six layers ensuring agents operate safely within defined boundaries.
Six Protection Layers
Circuit Breaker Protocol
Last-line defense against irreversible mistakes. Blocks all IRREVERSIBLE actions until approved.
Reversibility Assessment
Evaluates actions as IRREVERSIBLE (blocked), PARTIALLY_REVERSIBLE (approval needed), or FULLY_REVERSIBLE (proceed).
Impact Assessment
Data loss risk, security impact, system availability, recovery plan validation.
Bounded Autonomy
Each capability is limited to how far an agent may take it: from analysis only, through proposing changes, to applying them.
Human Approval Workflows
Approval is required based on the agent's maturity mode and the risk of the operation. Pending approvals expire rather than wait indefinitely.
Audit Trail & Compliance
Universal audit logging for EU AI Act compliance. Every action logged with decision reasoning.
Reversibility Assessment
Circuit Breaker Protocol
Every dependency an agent relies on sits behind a circuit breaker, so a failing service is isolated instead of dragging down the services that call it.
Normal
Requests flow through. Failures are counted.
Blocking
After repeated failures the breaker opens. Callers get an immediate, honest failure instead of a hang, and downstream services are protected.
Testing recovery
After a cooling-off period a few requests are let through. Sustained success closes the breaker; another failure reopens it.
Bounded Autonomy Tiers
Not every capability is allowed to go all the way. Each one is assigned a tier that caps how far an agent may take it, independent of how mature the agent is.
Full
The agent may research, inspect, generate, apply and review a change end to end, subject to ACMF mode and the quality gates.
Propose
The agent may research, inspect and generate a proposed change, but applying it is always a separate, human-owned step.
Analyse
The agent may research and inspect only: monitoring, code analysis and compliance reporting with no change generated.