safeguards-control-plane

That a safeguards component which observes decisions without standing in the execution path reports preventions that did not happen, and that telemetry sharing one writer with enforcement cannot detect its own enforcement failures.

Anything about a deployed safeguards product. The agent environment is synthetic and deterministic by design, so every number is a property of this pipeline under injected faults rather than a rate that transfers. No claim is made about which faults occur in practice or how often.

Two arms consume identical events with an identical evaluator, policy and injected faults, differing only in whether the control sits on the execution path or observes alongside. A second axis varies whether telemetry and enforcement records come from one writer or two.

Across 10,000 events with all faults injected and fail-closed policy, the monitoring arm recorded 1,026 as prevented and all 1,026 executed, with intervention recall of 0 of 818. The in-series arm recorded 6 of 9,880 prevented-but-executed and intervention recall of 697 of 818. Under a single writer the same run reported enforcement success of 906 of 906 with no divergences, against 900 of 906 and six divergences under two writers, and recorded six fewer unsafe executions than occurred.

The injected fault model, the synthetic event generator, the policy, and the assumption that the two arms differ only in enforcement position.

The distinction between a reference monitor on the path and a detective control alongside it is classical. What is measured here is the size of the reporting gap when the two are given identical inputs, and the separate effect of record authorship.

./demo.sh && make experiments

Findings drawn from this artifact are on the evidence ledger.