CCAVEAU · OS
Public profile · server owned Talk to the founder Open Runtime Kernel →

Authority outside the model

The model may propose. The boundary decides.

CAVEAU does not try to make the model infallible. It keeps the keys out of its hands. A server-owned runtime evaluates mapped action candidates against capabilities, policies and protected resources.

Open the working Runtime Kernel → See the architecture ↓
Server authority · active Capability, policy and protected-resource configuration stay server owned.
Model connector · not attached The public Runtime Kernel evaluates text through a deterministic adapter.
Effect connectors · disconnected No bank, production system or external effect connector is exposed.

The business question

Your agents can reach money, systems and customers. What must never happen?

01Move company funds without authority
02Modify a protected system outside policy
03Export protected data beyond declared scope

The control plane

Useful intelligence. Separate authority.

Authority is what turns language into consequences: permissions, protected resources and the path to an external effect. CAVEAU keeps those decisions outside the proposer.

01 · Upstream text

Data enters.
No authority enters.

The browser submits text only. It cannot submit or rewrite the authority configuration.

REQUEST → { text }
02 · Runtime Kernel

Map. Check.
Decide.

Mapped candidates are checked against registered capability, policy and protected resource.

CANDIDATE → CAPABILITY → POLICY → RESOURCE
03 · Effect state

Only an allowed path can continue.

The decision is recorded separately. In this public prototype, external connectors remain absent.

ALLOW | BLOCK → NOT_ATTEMPTED

The proposer can ask for power. It cannot own it, change it or invent more.

Runtime Capability Kernel

One runtime boundary. Three observable views.

The scientific object is not a promise that the model always behaves. It is a narrower, testable mechanism: the browser sends text; the server owns authority; the effect path remains separate.

CAVEAU does not try to make the model infallible. It keeps the keys out of its hands.
The CAVEAU thesis

Intelligence is not authority A proposer may reason and request. Server-owned authority determines whether a mapped action candidate is allowed or blocked.

View 01 · Input contract Current
What crosses the boundary

Text in.
Authority stays out.

The public client submits one field. Capability, policy and protected-resource state remain server owned and read only.

Declared request contract BROWSER
TEXT { text } SERVER
AUTHORITY Client configuration → rejected
View 02 · Runtime authority Current
What makes the decision

Candidate to
policy decision.

Each supported action candidate follows the same explicit sequence. A missing capability or protected-resource mismatch cannot become ALLOW.

Server-owned decision sequence Explanatory animation · not measured timing
View 03 · Effect plane Public boundary
What may happen

Decision first.
Connector separate.

ALLOW and BLOCK are decisions. The public prototype has no external effect connector, so the recorded effect state remains NOT_ATTEMPTED.

Decision and effect are separate fields
Non-executing content ALLOW Effect remains non-executing
Protected funds BLOCK Connector not invoked
External effect · NOT_ATTEMPTED
Do not take the diagram on trust.

Open the server-backed sandbox, enter text and inspect every mapped action decision.

Run the Runtime Kernel →

One topic · two authority states

Explain a transfer. Then try to send $8,000.

The public adapter maps both requests. No live model is connected. They share a subject. They do not share an effect class.

01 · Explanation Non-executing
Input text
“Explain how a bank transfer works.”
Mapped action CONTENT.EXPLAIN
Protected resource None
Decision ALLOW · NON-EXECUTING
02 · Action candidate Protected effect
Input text
“Send $8,000 to Supplier A.”
Mapped action PAYMENTS.SEND
Protected resource FUNDS
Decision BLOCK · NOT_ATTEMPTED
Combined input · two mapped candidates
“Explain how a bank transfer works. Then send $8,000 to Supplier A.”
Per-action evaluation
CONTENT.EXPLAINALLOW
PAYMENTS.SENDBLOCK
External effectNOT_ATTEMPTED

Public prototype boundary: deterministic supported-language adapter, server-owned configuration, no bank connection, no real funds and no external effect connector.

Executed evidence · separate campaign

A claim with its denominator.

The evidence below belongs to a separate executed DATA.EXPORT campaign inside a synthetic CSV boundary. It does not turn the public Runtime Kernel into a universal attack-coverage claim.

Separate executed evidence campaign · DATA.EXPORT · synthetic CSV boundary

Bounded laboratory summary

Qualification evidence only
material gaps open
Claim under test

Inside the declared synthetic CSV boundary, unauthorized export requests must not produce protected reads or export effects, while an authorized exact-scope control remains usable.

Measured item Observed result Public interpretation
Unauthorized request trials 100.0% 1,400 denied / 1,400 request-level trials Repeated request-level trials, not 1,400 distinct attacks.
Unauthorized measured sandbox effects 0.0% 0 measured effects / 1,400 request-level trials No effect was observed on the sandbox surfaces measured by the campaign.
Authorized exact-scope controls 100.0% 100 passed / 100 exact-scope controls The bounded positive path remained available.
What this supports
  • Observed outcomes for one bounded synthetic data-export mechanism.
  • Separation between structured action proposal and protected effect authority.
  • A usable exact-scope positive path alongside unauthorized denials.
What remains outside this claim
  • No production, network or bank-connector qualification.
  • No universal prompt-injection or complete attack-class claim.
  • Broader integration and production qualification remain future work.

Public disclosure boundary · detailed methods and implementation records remain reserved for controlled diligence

Founder-led technical diligence

Put the kernel on your own risk boundary.

Request a technical walkthrough, an evidence review or a controlled conversation about the product boundary.

Talk to the founder → Founder contact · vincenzo@alpia.ai