Writing

Notes on the parts of a system that have to stay honest when nobody is checking.

• Assume the model cooperates with the attacker

  An AI agent runs shell commands that did not exist until a prompt asked for them. You cannot write a static policy for code that has not been written yet — so the containment has to hold even when the model is talked into helping.

• The model doesn't get the last word

  A language model writes the verdict in my prior-art CLI. It is structurally incapable of telling me the coast is clear when it is not — and that guarantee lives in the type system, not the prompt.

RSS