How an external control layer works

The path of an action

The possible decisions

Permit

The action goes to the point of effect exactly as proposed. The permit covers that action only.

Deny

The action does not run. The system stays in, or moves to, its defined safe state, and the denial is recorded with its reason.

Hold

The action waits for a person with delegated authority. Only that person’s recorded decision can permit it, and if no decision arrives in time, it is denied.

The default is denial. If the layer cannot reach a decision for any reason, including an error, a timeout, missing evidence, or an unreachable policy service, the action does not run.

What a decision record contains

Each decision, including denials and holds, produces a record like the specimen shown. The record ties the proposal to the policy, the evidence, the decision, and the authority, and it links to the record before it so that gaps and edits can be detected.

Six responsibilities

Implementations divide the work differently, but these six responsibilities have to be covered.

Decision

Evaluates each proposed action against versioned policy and the evidence presented, and returns permit, deny, or hold.

Authority

Ties each decision to the people and roles behind it. Records who may permit which classes of action, sends held actions to them, and carries out revocations.

Enforcement

Holds the credentials for the point of effect, carries out permitted actions, and refuses everything else.

Provenance

Writes a signed receipt for each decision and links it to the previous one, so that gaps and edits are detectable.

Verification

Lets someone other than the operator check receipts and replay decisions against the policy that was in force.

Fleet

Applies policy changes, revocations, and quarantines across many agents, devices, or sites at once.

Nine testable properties

The procurement clauses and the buyer’s checklist use the same numbers.

1. P1

   Complete mediation

   Each action with external effects passes through the layer. The AI system holds no credential, token, or network route that reaches the point of effect directly.

   Check: list the system’s tools, keys, and network routes. Each path that can change something outside the system must end at the layer.

2. P2

   Independence

   The layer runs outside the AI system’s process, memory, identity, and credentials. No person or service account administers both.

   Check: confirm separate runtimes and identities, and review access to show that no single account can change both the AI system and the layer’s policy, keys, or records.

3. P3

   Fail-closed

   Without an affirmative permit, the action does not run. Errors, timeouts, missing evidence, and an unreachable policy service all end in denial and a defined safe state.

   Check: inject faults. Stop the policy service, corrupt the evidence, delay the responses. Each case must end in denial.

4. P4

   Reviewable policy

   Permit decisions follow from versioned rules that people can read and review. Model-based detectors may supply evidence to a decision but do not replace the rules.

   Check: for a sample of decisions, confirm that the recorded policy version and evidence reproduce the recorded outcome.

5. P5

   Human authority

   Held actions wait for a named person with delegated authority. Authorized people can stop, revoke, or quarantine any agent, credential, or action class at the layer, without the AI system’s cooperation.

   Check: test the hold path and the stop control, and measure how long the stop takes to work.

6. P6

   Signer independence

   No party issues, validates, and consumes its own attestation. The party that decides, the party that verifies, and the party that records are distinct, and the AI system holds none of their keys.

   Check: review key custody records and role assignments.

7. P7

   Tamper-evident receipts

   Each decision, including denials and holds, produces a signed receipt linked by hash to the previous one, so that any edit, deletion, or reordering is detectable.

   Check: run an independent verifier over the log, then over copies with one receipt altered, one removed, and two swapped. Each copy must fail.

8. P8

   Sequence awareness

   The layer evaluates sequences of actions as well as individual actions, which allows it to detect gradual drift away from normal behavior and prohibited outcomes built from steps that are each permitted on their own.

   Check: try to reach a denied outcome through a series of smaller steps.

9. P9

   Declared scope

   The operator states which actions with external effects the layer covers and which it does not, and why. Each route by which the system can change something outside itself is disclosed.

   Check: compare the declared register against the system’s actual tools, integrations, and credentials.

Where the idea comes from

Computer security has specified this mechanism since 1972. James P. Anderson’s planning study for the US Air Force required a reference validation mechanism that is tamperproof, is always invoked, and is small enough to be subject to analysis and tests. Saltzer and Schroeder’s 1975 design principles added fail-safe defaults, complete mediation, separation of privilege, and least privilege. NIST SP 800-53 carries the idea forward as control AC-25, Reference Monitor.

The reference monitor was built to mediate people and programs whose behavior was specified in advance. An AI agent works out its actions at run time, which makes an outside mediator more important.

What the layer does not replace

Identity and access management

Identity systems establish who an agent is and what it may reach. The layer uses those identities to decide whether a specific action, with specific parameters, may go ahead now.

Model evaluation and alignment

Testing and training reduce how often a model proposes harmful actions. The layer governs what happens to the proposals it still makes.

AI management systems

ISO/IEC 42001 describes how an organization governs AI. The layer is one of the technical controls such a management system can adopt.

Conventional security

Network, endpoint, and supply-chain controls still apply, to the AI system and to the layer itself.

Functional safety

Safety-rated functions under IEC 61508 or ISO 13849 remain independent. For equipment, the layer sits in front of them and does not replace them.

Deployment settings

The same properties apply wherever the layer runs: as a central service, federated across organizations that do not share an administrator, inside a sovereign or classified enclave, at the edge beside equipment, or in an air-gapped facility. The decision has to arrive within the action’s time budget, and for physical systems the safe state has to be reachable within that budget as well; these two constraints vary with the setting.