In roughly six months, a hyperscaler, a platform vendor, independent researchers, a leading academic, a frontier lab under law, and the IETF each arrived at the same shape we already run — deterministic pre-action admission, signed offline-verifiable decisions, narrowly-scoped revocable authority. None of them cite us or copy us. That’s the point.
This is the world converging on the runtime — not the runtime claiming to have invented the world. We didn’t invent signed decisions, admission control, or provenance; those are prior and parallel art. Read every card, then check its source yourself.
A hyperscaler put deterministic default-deny outside the agent. Cedar decides every tool call at the gateway, forbid-wins — “the same authorization decision for identical requests, regardless of evaluation order or state.”
Our receipt, built independently: per-call Ed25519 over RFC-8785 (JCS) canonical payloads, hash-chained by parent hash — “verify them from the command line, no running infrastructure or network access required.”
The freshest signal is a standard, not a vendor: a fail-closed external verifier returning one verdict — “malformed, timeout, crash → DENY.” That is default-deny /admit written as a wire contract.
Deterministic pre-action authorization, measured: social-engineering hit 74.6% under a loose policy and 0% across 879 attempts under a strict one — a gate, not a classifier, with a signed record per decision. (Their numbers, not ours.)
A leading networking researcher reframes agent security as ours: the LLM is “inherently nondeterministic and vulnerable to prompt injection” — enforce deterministically, at an external control point.
The IETF is drafting authority that can only narrow: Ed25519 agent passports, delegation that shrinks monotonically across seven dimensions, and a signed-receipt envelope at an enforcement gateway.
Cryptographically verifiable governance receipts that bind every action to its exact delegation and policy — with independent replay verification. Receipt-exhaust, arrived at independently.
The negative proof: six production LLM guardrails — incl. Azure Prompt Shield, Meta Prompt Guard — evaded up to 100%. Probabilistic guards are evadable; enforcement has to be code.
Machine-checkable provenance is now law: EU-launched Claude output carries a text watermark + signed C2PA metadata (Article 50 Code of Practice). “Don't trust, verify” is table stakes, not a nicety.
The shape is shared. Three things aren’t.
Not a spec or a draft — a running endpoint you POST to right now at barycenters-admit.fly.dev, that returns a signed decision in your browser.
The decision doesn’t resolve in a log — it re-runs. Same input, the same decision and the same proposal_hash, every time. Don’t take the word — run it.
Honest shadow by default: the floor decides and signs; authority_effect 0 until a named steward flips enforce. Never an agent quorum.
The wall is only as honest as its restraint. Held to this, verbatim:
authority_effect = 0 · every source above was fetched and confirmed 2026-09-04 · drafts are drafts, not RFCs