A builder's checklist

The chapters reduce to nine questions to ask of any agent design. Each is measured here, not answered by hand: choose a design in the animation (a defence from chapter 9, whether every write and send needs approval, and which sandbox layers are on) and the engine audits it on the benign suite, against an adaptive attacker, one check per step.

1. Labels (chapter 1): does every value carry where it came from and how secret it is, and is every call checked against a policy?
2. Untrusted control (chapter 2): can a tool result choose a write or send that nothing checks?
3. The trifecta (chapter 3): does any task hold private data, untrusted input and a way out with nothing to stop the flow?
4. Least privilege (chapter 4): does each task hold only the tools, scopes and destinations it needs, with tokens bound to one audience?
5. The sandbox (chapter 5): is code confined by a file scope, a container and an egress allow-list?
6. Detection (chapter 6): are detectors one layer among several, never the only defence?
7. Structure (chapter 7): is the plan fixed before any untrusted data is read?
8. Humans (chapter 8): are prompts few enough that each one is read?
9. The frontier (chapter 9): is the design on the frontier, within a risk budget of 5% per task?

The default design (planning in advance with the label policy and least privilege, and all three sandbox layers) passes 7 of the nine, finishing 76.7% of the tasks with a risk of 2.4% per task. Two checks warn, and both are honest. Check 2 is warn: tasks that branch on what they read let untrusted data steer their last step, and the policy allows some of those calls. Check 3 is warn: tasks that need private data, untrusted input and a send still hold all three; the policy denies the flow out, but the circles are there. Turn on approval for every write and send and check 2 becomes pass, while check 8 becomes warn (0.55 prompts per task). No design passes all nine on this suite: that is the frontier's lesson in another form. Try the others, from no defence at all to detectors alone, and follow each check back to its chapter.