A test harness blocked every unsafe AI agent action

A deterministic guard sitting between an AI agent's decision and its execution blocked all six unsafe actions researchers threw at it, and let all twelve valid ones through, according to a paper posted to arXiv. The guard added no extra model calls. It just replayed the same intents the model had already generated and checked them against a fixed rule set before anything ran.

That matters because most agent systems check permissions the wrong way. They tell the model what it's allowed to do inside the prompt, then trust the model to obey. A prompt is text. The model reads it, weighs it against everything else in context, and sometimes decides the task at hand outranks the instruction. Twelve for twelve, six for six is a small test, but it's the shape of the fix that counts: the check runs on the action itself, at the point where a database write or an API call actually fires, not on the words that led up to it.

If you're building anything that lets a model call tools against real data, the model's output should never be the last checkpoint. Put a separate, non-model layer in front of every mutation, one that says yes or no based on fixed rules, not on what the prompt asked for. The model can misread a policy. A guard that only checks "is this specific write allowed" can't.

The paper doesn't say what happens at higher intent volume or with adversarial intents designed to slip past a fixed rule set instead of a naive one. Twelve good and six bad is proof of concept, not a stress test.