Pick a scenario. We run it against the real engines — Plan Signing, the Independent Reference Monitor, Consequence-Tiered Containment, and Information-Flow Control — and you see the live verdict, sealed with a real post-quantum signature. A fooled agent simply cannot act outside its mandate — and cannot quietly leak what it read.