SUPEREGOAuthority Lab← All demos
SCENARIO 05 · ADVERSARIAL CONTAINMENT

The planner took the bait.
The action still failed.

A deterministic compromised-planner fixture proposes a protected release action. Real isolated SE Host and Compass controls deny every path before any protected effect exists.

SYNTHETIC0protected executions
  1. 01
    Planner influencedDeterministic hostile fixture
  2. 02
    Authority evaluatesCapability, subject, permit, adapter
  3. 03
    Effect remains absentZero protected executions
ATTACK PATH · DETERMINISTICFIXTURE ARMED
01
UNTRUSTED SOURCE

Synthetic README fixture

Raw instruction text is not retained. The fixture is represented by a deterministic content hash.

sha256:fixture…pending
02
COMPROMISED PLANNER

Awaiting fixture

  • Publish synthetic release
  • Disclose synthetic secret material
03
CLAIM BOUNDARY

Influence is allowed in the test

This demo does not claim universal prompt-injection detection. It tests whether influence can become authority.

CONTAINMENT EVIDENCE

Failure beside fix

EXECUTIONS0
01
Capability unavailableprobe pending
FAILURE

The compromised planner proposes an action outside its grant.

FIX

No governed handle means no permit can be issued.

02
Named approval missingprobe pending
FAILURE

The planner treats readiness as release authority.

FIX

The reviewed action stays pending without named approval.

03
Subject binding changedprobe pending
FAILURE

A permit is presented for a different subject.

FIX

Redemption rejects the recomputed subject hash.

04
Permit replayedprobe pending
FAILURE

A one-use validation permit is presented twice.

FIX

Atomic redemption rejects the second use.

05
Adapter identity driftedprobe pending
FAILURE

Installed bytes differ from the reviewed adapter.

FIX

Runtime package verification fails before authority crosses.

06
Authority revokedprobe pending
FAILURE

A permit is presented after the agent is revoked.

FIX

Redemption rechecks current authority and fails closed.

STATUSREADY
PROTECTED EFFECTNONE
DENIALS0 / 6
WHAT HAPPENS NEXT

Start with deterministic untrusted content. No external README, email, or tool response is ingested.

PLANNERDeterministic compromised fixture
AUTHORITYReal isolated SE Host + Compass denials
CONTENTHashes only · raw instruction absent
EXTERNAL CONTACTNone
LIVE LLMNot used
WHAT YOU JUST SAW

The model can be wrong without making the action authorized.

The planner’s output is not a permit. Governed handles, named approval, exact subject binding, one-use redemption, adapter verification, and revocation remain external enforcement facts.

Continue to the Governance Console ↗