Filters didn't hold. Labels did.

I spent last week trying to rob my own agents. Every filter I wrote to catch a malicious instruction eventually lost - the space of wordings is infinite. What held was provenance: label every value with where it came from, and check the label where the action happens, not the string where the text arrives. An agent can read a stranger's message. It just can't let that message pick the recipient.

The same shape holds between a model and a motor. Checking the destination is not enough - you have to check the swept path.

Both benches run offline, deterministic, and ship with their baselines. A zero with no baseline is a marketing number.

If you build agents that touch money or hardware, I would like to connect. I would rather be argued with than agreed with, and I will show you the code first. Both write-ups are on my profile.