Projects · Agent control · Research prototype · MEASURED
safeguards-control-plane
What this establishes
That a safeguards component which observes decisions without standing in the execution path reports preventions that did not happen, and that telemetry sharing one writer with enforcement cannot detect its own enforcement failures.
What this does not establish
Anything about a deployed safeguards product. The agent environment is synthetic and deterministic by design, so every number is a property of this pipeline under injected faults rather than a rate that transfers. No claim is made about which faults occur in practice or how often.
Trusted base
The injected fault model, the synthetic event generator, the policy, and the assumption that the two arms differ only in enforcement position.
Method
Two arms consume identical events with an identical evaluator, policy and injected faults, differing only in whether the control sits on the execution path or observes alongside. A second axis varies whether telemetry and enforcement records come from one writer or two.
Result
Across 10,000 events with all faults injected and fail-closed policy, the monitoring arm recorded 1,026 as prevented and all 1,026 executed, with intervention recall of 0 of 818. The in-series arm recorded 6 of 9,880 prevented-but-executed and intervention recall of 697 of 818. Under a single writer the same run reported enforcement success of 906 of 906 with no divergences, against 900 of 906 and six divergences under two writers, and recorded six fewer unsafe executions than occurred.
Negative controls. Negative controls run as part of the demo path, and 31 unit tests run without the broker.
Reproduce
./demo.sh && make experiments- Toolchain
- Python, Docker Compose, Redis; offline on one machine, about three minutes for the measured run
- Verified at
- https://github.com/repowazdogz-droid/safeguards-control-plane@08e52549 (2026-08-12)
This pass. Confirmed by source read at commit 08e52549; not re-executed in this pass.
Independent reproduction
None known.
Prior art and positioning
The distinction between a reference monitor on the path and a detective control alongside it is classical. What is measured here is the size of the reporting gap when the two are given identical inputs, and the separate effect of record authorship.