Every one runs at the tool boundary, outside the model, where the agent holds no keys. A rule in a prompt is a request the model can drop. The same rule in the gateway is enforced whether the model agrees or not.
Every action is scored by what it would cost to undo: a new beneficiary, a large amount, a pattern the ledger has seen before. Above the risk gate the action fails closed and waits for the owner of that corridor.
Silence means no. A hold nobody answers expires, and an expired hold never runs.
A test-sized probe goes first. The ledger confirms it landed, then the real transfer follows. If the probe fails, nothing else moves.
The canary is a gateway setting, so the agent cannot skip it.
Finance holds route to AP. Communication holds route to marketing. Below your tier, the approve button does not exist. An intern can launch the procurement bot; the $48,200 approval still lands with the AP manager.
If the owner does not answer, the hold escalates up the chain and the clock resets. Leavers reroute automatically, vacations delegate, and the top tier can require two people.
PII becomes vault tokens before the model reads it. The tool returns [email protected]; the model sees ⟨customer#4821⟩. The agent cannot leak what it never saw.
Egress is gated like dollars: 3,200 records headed outside fail closed. Every field that crossed the boundary is in the lineage ledger, hash-chained. Residency routing, so EU data stays on EU brains, is on the roadmap.
Every destructive call snapshots first: database deletes, file and config changes. Undo is one click inside the window.
"Undo everything" would be a lie. Each action class gets the strongest recovery verb physics allows, and you know which one before the agent acts: reversible for writes and deletes, delayable for anything that leaves the building, compensable for payments and commitments.
Mass sends leave in batches, stoppable at #50, not #2,000. Outbound email gets an unsend window before anything leaves the building. High-reach publishing is held in escrow, then released batch by batch.
Three tripwires. Velocity: CUSUM windows add up flows over 24 hours, so five payments of $9,640 get caught as one $48,200, at payment two. Burst: three holds inside an hour and the engine freezes the agent on its own. Arguing: the same action re-submitted after a human said no freezes it on the spot.
A frozen agent gets nothing through. Whatever it still tries is refused in review, and it stays frozen until a person thaws it.
Every incident lands in the Near-Miss Report as a conduct grade per agent, A to D: drift off mandate, escalation after a no, velocity, off-hours activity, egress. Trust comes from the ledger, not from the model's report card.
Methodology, thresholds and the grading rubric are public: the Ripcord Index.
Gate = P × $exposure × (1 − recoverability)Expected-loss gating. Severity is discounted by our own ability to undo: a snapshot-protected deletion tolerates five times the risk of an irreversible wire.Σ flows(24h) > h ⇒ escalateCUSUM velocity windows. Aggregates get scored, not just single actions. The structuring attack dies at payment two.