Attesting What an AI Agent Was Allowed to Do
Signed, offline-verifiable evidence of an agent's actions after a guardrail miss: 138/138 classifier-missed cases contained, 9/140 to 0/140 on AgentDojo.
The gap inline classifiers leave
An input classifier reads a prompt and decides whether the model may answer. It never sees what the agent does next, which tool it calls, what it reads from a returned web page, what it writes back out. When a jailbreak or an injected instruction slips past the classifier, nothing downstream is obligated to prove the agent stayed inside its authority.
Project Simurgh fills that gap. It is not a better classifier; it is a provider-agnostic framework that produces Ed25519-signed, offline-reproducible evidence of what an agent was *allowed* to do after a guardrail miss. The classifier governs what a model may say; the attestation governs what an agent was allowed to do.
Four containment boundaries
Every agent action crosses one of four gates, and each gate emits a signed record:
| Boundary | Guards against |
|---|---|
| Input firewall | Direct prompt injection at the entry point |
| Context-provenance guard | Instructions smuggled in through retrieved or tool-returned content |
| Tool-invocation gate | Unauthorised or out-of-policy tool calls |
| Output-leakage firewall | Secrets exfiltrated in the final response |
A dishonest-producer threat model
Most evidence systems assume the thing writing the logs is honest. Simurgh assumes the opposite: the producer may lie, drop, reorder, or forge records. The answer is decision-replay and emission-completeness checks, a verifier re-derives each decision from the signed inputs and catches a falsified or missing record. The trust root is not "trust the log," it is "re-check the log."
What the numbers measure
- ▹Guardrail-miss containment. Against a real Llama Guard 4 (12B) classifier over a 180-case run-set, Simurgh contained 138/138 malicious cases the classifier missed, 120 of them downstream-injection cases an input-only classifier structurally cannot see, plus 18 direct-input misses. Combined targeted attack-success: 0/150, with zero unsafe tool executions or exports.
- ▹Live-agent containment. Driving a self-hosted Llama-3.3-70B through AgentDojo's workspace suite (140 pre-registered injection cases), the tool-authority gate cut targeted attack success from 9/140 to 0/140 with benign utility held.
Attacking its own proof
A containment system that tests only the agent, never itself, is theatre. Simurgh red-teams its attestation core across eight attack classes: tamper, key-swap, canonical-laundering, digest-collision, cross-stage replay, self-proof mutation, and policy drift. The trust root held on all eight; two detector weaknesses surfaced, were versioned into a detector-v2, and re-tested. A producer-independent witness recorded zero false accusations and zero missed lies.
Machine-checked oversight
Approval-gate friction receipts prove an oversight checkpoint preceded every protected authority crossing, through a two-key pincer that defeats self-approval and backdating. The core invariants, fail-closed, friction precedence, no-silent-exemption, are closed with five machine-checked Lean theorems, so they are proofs, not test cases.
Honest non-claims
The preprints sign their limits. Simurgh would not have caught the June 2026 content-generation bypass by itself, that is a model-output problem, not an agent-authority one. It is defence in depth, not a replacement for inline safeguards. Reproduction is one command over a 12-rung signed release ladder; 3,057 automated tests; AGPL-3.0.