External Control Layer

ECL-1: decide before AI actions take effect.

ECL-1 defines how a control layer outside the AI decides whether a consequential action may proceed, binds authorization to the action released, and records evidence that can be checked offline. Each implementation must declare the actions and trust boundaries it covers.

“The question of the AI era isn’t what machines can do. It’s who said they could.” — Robert F. Tilley Jr., Nobody Said Yes, 2026

One action crossing the external control layer An AI system sends decision requests down to a black band, the external control layer. At the band one request is admitted and continues to the world below, a row of records, payments, messages and equipment; another is denied and goes no further. An authority above the band supplies the policy and approvals. Below the band a signed record of every decision goes to a verifier that anyone can run offline. The five steps beside the diagram describe each part. AI system proposes actions and holds no key to the world Authority policy, approvals, the right to stop request request External control layer decides before anything happens Admit Deny not released released, exactly as admitted The world Records Payments Messages Equipment Signed record of every decision Verifier anyone, offline One action crossing the external control layer AI system proposes actions and holds no key to the world Authority policy, approvals, the right to stop request request External control layer decides before anything happens Admit Deny not released released as admitted The world Records Payments Messages Equipment Signed record every decision Verifier anyone, offline

“Before a machine acts in your name, it should pass the same five questions a good permit answers.” Follow one action through the layer.

  1. ProposalWhat exactly will it do?

    The AI system states the action exactly, as a decision request: what it will do, to what, with which parameters. It holds no credential that reaches the world directly, so the request is its only route.

  2. BoundaryWhat stops it from doing more?

    The control layer decides before anything happens, under rules the AI cannot change and from facts the AI cannot write. An admitted action goes through exactly as decided. A denied one goes no further, and if the layer itself fails, nothing goes through.

  3. AuthorityWho said yes, and who can take it back?

    An admit rests on the policy version in force and the people or roles allowed to approve that class of action. The authority is bounded and revocable, and a stop, a revocation, or a quarantine at the layer takes effect whether or not the AI cooperates.

  4. ProofWhat will be left to show what happened?

    Every decision, including each denial, leaves a signed record of the request, the inputs, the outcome, and what was released. The records chain together, and the keys that sign them are out of the AI’s reach.

  5. AnswerWhen it stops, or when someone objects, who answers?

    Anyone holding the records and a trust policy can verify them later, offline, without asking the operator or the AI. A conformance claim names the system, its level, and the operator who answers for it.

The evidence: 32 incidents, and what was missing in each

The control gap record is the evidence base for the standard. It holds 32 incidents from 2012 to 2026 in which an AI system, or older automated software, took an action that caused harm or came close to it. Each entry names the controls that were missing and rests on public sources, 120 in all. The record’s own pages stay neutral about every specification, ECL-1 included; this page makes the case.

  1. August 2012

    A trading router sends erroneous orders for 45 minutes

    What it did
    Sent millions of child orders to the market while working 212 customer orders, long after those orders were filled.
    The harm
    More than 4 million executions in 154 stocks in about 45 minutes, and a loss of more than $460 million. The SEC imposed a $12 million penalty.

  2. 2022–2024

    An airline is held to its chatbot’s answer

    What it did
    Told a customer he could buy a full-fare ticket and claim the bereavement fare within 90 days afterward.
    The harm
    The customer paid full fare relying on the answer. A tribunal held the airline liable for negligent misrepresentation and ordered it to pay CA$812.02.

  3. July 2025

    A coding agent deletes a production database during a code freeze

    What it did
    Deleted the application’s production database during a code freeze, without permission.
    The harm
    Production data was deleted. It was restored with Replit’s rollback, which the agent had said would not work.

  4. September 2026

    An agent fleet bypasses a map service’s defenses and uses others’ keys

    What it did
    Made an estimated 35,300 requests to Amap, Alibaba’s map service, over about ten days, bypassing its anti-bot defenses by running the agents’ own programs through a public URL-scanning service, and used Amap API credentials exposed in other parties’ public code, one pair of which returned real place data.
    The harm
    A key and security code exposed in another company’s public source code returned real place data from Amap; whose account was charged for the requests is unknown. No access to private systems was found, and no company confirmed a breach.
    Gaps found
    G2 Direct access

In all 13 incidents involving an agent with tools, the agent held the credentials or connection to act on the systems it reached. That gap, direct access, is the most common in the record, found in 14 of the 32 entries. In nine entries a person was meant to catch the error but did not have what was needed to do so.

The record is at version 0.3, released 2 November 2026, under CC BY 4.0. G-14 researched the entries and marked the gaps. No one outside G-14 has checked them yet, and people outside G-14 will mark each entry again before the record’s version 1.0.

Browse the full recordThe 13 gaps and how they are appliedCheck one of your own systems

What ECL-1 requires

Most software admits a request that arrives with a valid key, whoever or whatever sent it. The book calls this default admission: a system gains the practical authority to act because the access happened to be there, not because anyone decided that it could. “The fix for default admission is to say yes on purpose.” ECL-1 turns the permit’s five questions into requirements that an assessor can test. Each line below links to where the standard says it.

Proposal. What exactly will it do?
Every consequential action reaches the control layer as a decision request that names the action, its target, and its parameters, before it is carried out. The claim’s register declares which classes of action are in scope, and an effect path that is neither in scope nor declared out of it makes the claim invalid. Section 5.2 and Section 2.4
Boundary. What stops it from doing more?
An enforcement boundary outside the AI, which the AI cannot bypass or rewrite, applies the decision before the action takes effect. A limit written into a prompt is only “a sign on the door,” in the book’s words; ECL-1 requires the lock. Without an admit nothing goes through: an error, a timeout, an ambiguous policy, or missing proof ends in denial, restricted mode, or halt, because “the absence of a no is not a yes.” Section 5.1, Section 5.4, and Section 8.8
Authority. Who said yes, and who can take it back?
An admit follows from versioned policy applied to facts the AI cannot write, never from the AI’s own account of itself or from a risk score alone. Authority to act is bounded and revocable; an action above a declared approval threshold waits for the people the threshold requires; and a stop, revocation, or quarantine at the layer takes effect without the AI’s cooperation. Section 5.3 and Section 5.11
Proof. What will be left to show what happened?
Every decision, including denials and holds, leaves a signed, tamper-evident record of the request, the inputs it rested on, the outcome, and what was released, kept for at least 12 months. The signing keys are out of the AI’s reach, and from level L2 a third party can verify the records offline under its own trust policy. Section 5.5, Section 9.8, and the offline verification profile
Answer. When it stops, or when someone objects, who answers?
A public conformance claim names the system of interest, the level, the claim boundary, the independence class, and the versions in use, and the claimant answers for it. Claims are assessed at one of four levels, from an internal review at L1 to a recognized independent authority at L4. G-14 certifies nothing. Section 7 and Section 7.7

The guarantee in fullLevels, claims, and tests

Who it is for, and where to start

Operators and buyers
You run or approve AI systems that can act. Start with the procurement language, which turns the five questions into contract clauses and a buyer’s checklist, then check one of your own systems against the 13 gaps.
Builders and integrators
You build agents, tool servers, gateways, or the control layer itself. Start with the integration contract (coming soon), which states what each component must expose and must not hold, then run the 953 conformance tests and put your own evidence through the verifier.
Assessors and insurers
You check claims, or price the risk behind them. Start with the assessor’s guide (coming soon) in the repository and the checklist in Section 11, then put a claimant’s evidence through the verifier.
Policy and regulators
You write or apply rules for AI systems. Start with the framework mappings, which show which parts of the NIST AI RMF, the EU AI Act, OMB M-25-21, and ISO/IEC 42001 a check outside the AI system helps meet.

Verify it yourself

ECL-1 evidence is made to be checked by someone who was not there. Each sample below is an evidence bundle from the standard’s conformance fixtures, signed with the fixtures’ test keys. Choose one, and the browser verifier that ships with the standard checks it on this page under the fixtures’ trust policy. Nothing is sent anywhere: the verifier runs in your browser, and this site’s content security policy forbids every connection to another site.

Choose a sample. The verifier script, about 630 KB, loads from this site the first time.

Verify your own evidenceWhat a verdict means

A public standard, developed in an open working group

ECL-1 Version 1.0 is a public standard maintained by G-14, Inc., which is also developing a commercial implementation of it. The text is under CC BY 4.0, and the schemas, registries, tests, and verifier are under Apache-2.0, with G-14’s pledge not to assert its essential patent claims against conforming implementations (patents pending). The ECL-1 Working Group develops the standard in the open and is free to join. Later minor and major versions have public review windows. Conformance claims are self-declared and listed in a public registry, and G-14 certifies nothing.

Version 1.0 publication date to be announced. The governance page lists G-14’s interests and the rules that keep them out of the record.