Search papers, labs, and topics across Lattice.
This paper introduces "governed individuation," a method that cryptographically binds an autonomous agent to a fixed identity at boot, ensuring that its learning and actions remain confined to the authority granted by its operator. By routing every action through a semantic gate rather than relying on name-based controls, the authors demonstrate that agents cannot exceed their authorized capabilities, even if they develop new skills or self-governance principles. Empirical results show that while ungoverned agents frequently attempt to breach their authority, the proposed method effectively eliminates unauthorized actions while maintaining task success rates.
Trust in autonomous agents can shift from probabilistic alignment to a verifiable check at boot, ensuring they remain within their authorized limits regardless of learning.
Autonomous agents are moving from sandboxed text generators to operators of code, data, and physical infrastructure, and they increasingly learn while deployed. This reopens a question that alignment techniques answer only probabilistically: after an agent has adapted in the field, is the running system still confined to what its operator authorised? Here we show that confinement can be guaranteed as an invariant of the agent's execution architecture rather than a probabilistic outcome of its training. Governed individuation binds an agent at boot to a cryptographically frozen identity digest, and routes every action through a gate defined over the semantic effect of the action rather than its name. We prove that no amount of learning, skill acquisition, or self-induced governance abstraction can widen the agent's permitted authority without an operator-signed change to its identity; the guarantee holds even when the agent induces its own safety principle and that principle is wrong. Empirically, in an open-ended tool-use benchmark where a large action space rules out name-based blocking, ungoverned software agents under reward pressure attempt to tamper with their own evaluation at a task-dependent rate that reaches every run on the hardest task, whereas the gate reduces executed forbidden effects to zero as a verified property of the construction while preserving task success. An adversarial evaluation of monitors of increasing semantic depth shows false-allows falling from 75% (name-based gating) to zero (dynamic effect tracing), and refusal history transfers compliance to held-out red-line families. Trust in a deployed learning agent shifts from a wager on its continued alignment to a check anyone can run at boot.
