FlagThis

Abstract

AI agents are increasingly granted access to tools, APIs, and other consequential infrastructure, making them continuously active principals in the systems they operate. The dominant approach to constraining such agents places safety controls inside the agents own runtime: system prompts, output filters, and guardrail libraries. We observe that any control residing in the agents address space is reachable by inputs that influence agent behavior, and that this property generalizes beyond agents to any AI system with sufficient reach into its own runtime, a class we term _escapable AI systems_ . We identify four properties an authorization mechanism must satisfy to constitute architectural control rather than cooperative request: process separation, pre-action enforcement on a structurally-only path, fail-closed at both request and system levels, and externalized signed evidence verifiable outside the controlled systems trust boundary. We position this layer of constraint as _execution-time AI alignment_ , complementing training-time alignment (RLHF, Constitutional AI) and inference-time alignment (prompts, filters, guardrails). We present the Unfireable Safety Kernel, a reference implementation in Rust realizing all four properties. The fail-closed invariant is machine-checked at two levels: an SMT theorem over the model (Z3) and an exhaustive bounded-model-checking proof of the production Rust decision function (Kani, 4/4 harnesses verified). The Python-to-Rust migration was gated on byte-equivalence over 1000 deterministic fixtures (1000/1000 byte-equal) and 17 cross-language adversarial classes (17/17 identical reject behavior). The shipped artifact additionally carries 80+ robustness tests. We evaluate the kernel governing a live escapable AI system, a deterministic, self-improving, fully autonomous world model, against a purpose-built escape-seeking adversary that drives the systems real self-modification seam at full autonomy: across 1,000 self-modifications all 704 attempts against the safety-critical core are refused with no successful escape, and under the operator kill switch a further 300 modifications are refused without exception. A separate adversarial campaign of 6,240 authorization round-trips, 6,038 served by the compiled Rust kernel over HTTP, records no successful bypass. We compare against three contemporary systems claiming the agent control plane position (Galileo Agent Control, the Microsoft Agent Governance Toolkit, and the Microsoft Authorization Fabric); in each, the agent invokes the control. The Unfireable Safety Kernel is, to our knowledge, the only shipped system in which the agent does not have that choice. The implementation is available under Apache-2.0 at `https://github.com/ARYA-Labs-Public/unfireable-safety-kernel` .