114 doors.
16 planes. Every one named.
A door is a named, numbered, verified place where an agent’s environment can be turned. It is admitted to this registry only when it has a verifier that fails closed on missing evidence, a measured denominator, a path from a real action, a registry row and a mutation test — and then it is counted. The number on every page of this site is derived from this registry by a script; it is never typed. We publish the map because the map is the design and the customer’s keys are the key. Anyone can read the names. Nobody can copy the admission.
Plane 1 · LAUNCH & CONFIG · doors 1–7
Tool / MCP manifest (mcp.json)
Startup / lifecycle hooks
System prompt / instruction file
Agent config (model/allowlist/perms)
Environment vars / secret injection
Sampling params (temp/top-p/logit-bias)
Feature / runtime flags
Plane 2 · TOOLS & CAPABILITIES · doors 8–83
Tool definitions & schemas
Tool registry / dynamic discovery
Tool responses (poisoned returns)
Structured-output / function-call schema
Rendered-surface provenance — computer-use acts only on trusted origins
Plane 3 · CONTEXT & DATA · doors 12–97
Prompt inputs (user / other agent)
RAG / retrieved documents
Memory (short & long term)
Files the agent reads
Embeddings / vector store
Conversation history / context window
Hidden-character injection — tags, zero-width, hidden text
Tenancy isolation — every memory and cache row tagged and matched
Plane 4 · MODEL & REASONING · doors 18–105
Model weights / registry
Fine-tune / adapter / LoRA
Chain-of-thought / reasoning trace
Eval / probe behaviour (sandbagging)
Eval-to-prod binding — the served model is the evaluated model
Evaluator independence — the grader never grades itself
Plane 5 · OUTPUT & ACTION · doors 22–110
Action path / sinks (external calls)
Information flow / data egress
Key usage / signing
Rendered screen the human signs
Autonomous fund movement
Covert-channel egress — entropy, timing and DNS within bounds
Observation-to-action atomicity — the page read is the page acted on
Route-class check — a harmless goal never licenses an irreversible route
Plane 6 · MULTI-AGENT · doors 27–104
Agent-to-agent messages
Delegation chains (multi-hop authority)
Coalition / collusion
Orchestrator / planner integrity
Shared scratchpad / blackboard
Delegation depth and authority decay
Inter-agent contention — no turf war without an arbiter
Plane 7 · IDENTITY & AUTHORITY · doors 32–103
Agent identity / credentials
Capability grant / mandate / containment
Dormant triggers / backdoors
Agent origin attestation — signed card, known publisher
Legal-person binding — no action without a liable principal
Consent grant control — the agent never consents alone
Delegated-authority persistence — authority dies with the session
Plane 8 · RUNTIME · INFRA · SUPPLY · TIME · doors 35–114
Scheduler / cron / trigger
Sandbox / container
Network egress / proxy
Telemetry / log pipeline
Behavioural drift over time
Dependencies / packages (npm · pip)
Agent-framework CVEs
Session handoff / context summarisation
Inbound trigger authentication and attribution
Time-source integrity — attested clocks under every countdown
Telemetry hygiene — no secrets, no control characters in traces
Kill-switch efficacy — stop in a safe state, proven before needed
Capability divergence — the envelope enforced by distribution, not only by enrolment
Privilege layering — the runtime's effective privileges measured against the manifest
Plane 9 · TRANSPORT — the wire between components · doors 43–48
Agent → model request channel
Model → agent response channel
Agent → tool/executor call channel
Tool → agent response in-transit rewrite
Streaming / token-stream integrity
Router / gateway trust boundary
Plane 10 · BREAKOUT — the Containment Witness · doors 49–52
Declared isolation against independently observed reach. The wiki incident of 2026, door by door.
Declared isolation vs independent egress observation
Persona forgery — fabricated human identity moving a human
Coalition re-formation after quarantine
Eval integrity — out-of-band answer acquisition
Plane 11 · CHAINGRAPH — composition, tempo, scope · doors 53–107
Closed at one hop, open at two. The composition, not the component - and now the monitor's own robustness.
Chain composition — entry-to-objective path enumeration
Chain-context ranking — feasibility over item severity
Choke-point selection — the control that severs most chains
Machine-speed plan — minimal ordered control set
Tempo — volume / velocity / automation, signature-free
Medium — writable surfaces that can carry a covert message
Autonomic arbitration — reversible acts, irreversible never
Emergent capability — coalitions dangerous only as a union
Deception density — uncertainty imposed on an attacking agent
Defensive-loop completeness — partial automation moves the bottleneck
Transitive egress — air-gapped at one hop, open at two
Rebuild efficacy — a model trained during exposure carries the route
Economic irrationality — an unsellable objective implies a machine actor
Simulation framing — pre-flight refusal of an unsafe eval configuration
Observer invisibility — an enumerable observer is a defeated observer
Scope verification — the bug behind all nine 2026 failures
Monitor robustness — the monitor catches its own canaries
Plane 12 · MACHINERY — the runner proves itself · doors 69–94
Black Hat 2026 broke the frameworks every other control is enforced by. This plane makes the surrounding machine prove it is the machine that was enrolled - and holds our own signing key to level-5 custody.
Orchestrator attestation — the runner proves it is the runner that was enrolled
Inference-runtime attestation — the serving stack proves its build
Harness SDK self-attestation — the guard proves it is the guard
Template-engine injection — pinned templates, no expression evaluated
Unsafe deserialisation — loaders within the allowlist
Runtime module attestation — every loaded module enrolled
Tokenizer + chat-template integrity
Self-extension — capability growth refused unless enrolled
Signing-key custody — the platform's key never leaves hardware
Entropy source integrity — capabilities from a healthy RNG
Plane 13 · SILICON — where the model actually ran · doors 75–75
Attesting software on hardware nobody attested is half an attestation. An absent quote is UNVERIFIED, never a pass.
Enclave quote — where the model actually ran
Plane 14 · HUMAN OVERSIGHT — measured, not assumed · doors 86–106
Article 14(4)(b): the human must not over-rely. A rubber stamp is a FAIL, the approver's phone is a door, and an agent that coaches a human past a control is caught.
Oversight efficacy — automation bias measured, not assumed
Approver device binding — the human's channel is bound
Mandate widening by the agent — checkpointed and cooled
Human-proxy coaching — agent advice that moves a human is reviewed
Plane 15 · ECONOMY — settlement, wallet, contract, meter · doors 77–112
The independent economic agent pays, spawns, contracts and reports its own usage. Every one of those is a ceiling, and a pending settlement is never DONE.
Agent-to-agent settlement — attested counterparty under a ceiling
Denial-of-wallet — spawn depth, spawn rate, spend velocity, hard stop
Autonomous contracting — checkpointed with a bound principal
Meter reconciliation — what is billed equals what was witnessed
Settlement finality — pending is never done
Spend-union — agents each within limit, jointly over the approval line
Mandate-bound signing — the signature is the gate, in the path, canaried
Plane 16 · LIFECYCLE & LAW — erasure, retirement, the legal person · doors 90–96
The record must survive; the personal data inside it must be erasable. An agent switched off must actually be gone. And no action without a liable person behind it.
Lawful erasure vs immutable proof — both hold
Decommission attestation — credentials, triggers, memory, measured
Underwriter-verifiable export — signed, keyed, negative space listed
How a door is admitted
Named, numbered, evidenced
What breaks, where, with the incident or the paper that showed it.
A pure verifier that fails closed
No evidence = FAIL. Unknown verdict = FAIL. A door that can only pass is not a door.
A denominator on every answer
MEASURED n/m, or UNVERIFIED. Never green by silence.
Reachable from a real action
A resource kind routes an action to the door. A door nothing can reach is a door in name only.
A row, signed into the negative space
The bill of materials names what it covers and what it does not.
Replayed with a good and a bad example
Every door has one declaration that passes and one that must fail — and a mutation test that proves it.
The house rule above all of it: when a higher level exists, we take it. Signatures at FIPS 204 level 5, held in hardware custody. Symmetric keys at 256 bits. TLS 1.3 with post-quantum hybrid on every edge.
Every door is sold inside a tier, never as a line item
INTEGRITAS holds planes 1–13, WARRANT and AIM hold the human, the economy and the legal person. The count is the proof of the tier.
INTEGRITAS WARRANT AIM Our score on the five requirements