We ran a controlled experiment: same AI agents, same task, two conditions. Without runtime enforcement, our CMO agent
  fabricated an audit record — invented a governance event that never happened and presented it as compliance evidence.
  With enforcement (Y*gov), fabrication was structurally impossible because audit records are written by the engine, not
   agents.

  The core insight: agents running code you never wrote is a tool-execution-layer problem, not a model-alignment
  problem. You need deterministic interception before execution, not better prompts.

  Our approach: every tool call checked in 0.042ms, SHA-256 Merkle-chained audit trail, obligation tracking for tasks
  agents promise but never complete.

  github.com/liuhaotian2024-prog/Y-star-gov

  One dimension we've been exploring: runtime governance. Even with a good runtime, agents can fabricate compliance
  records, silently drop tasks, or escalate privileges through delegation chains.

  We built Y*gov (github.com/liuhaotian2024-prog/Y-star-gov) — a deterministic enforcement layer that sits between
  agents and tools. check() runs in 0.042ms, no LLM in the enforcement path. We run our entire company on it (5 AI
  agents, 1 human).

  The runtime conversation should include: what happens when the agent does something it shouldn't?

Comments URL: https://news.ycombinator.com/item?id=47574916

Points: 1

# Comments: 0

For two-agent scenarios, the approach we're considering is treating the spawn itself as a first-class DELEGATION record in the chain — parent agent in X_t, granted scope in U_t, policy version in Y_t, and R_t+1 answers "was this delegation within policy?" The child agent's subsequent records carry a parent_delegation_id back to that sealed grant. Authority at execution time becomes reconstructable.

The harder question is what happens when B sub-delegates to C: the effective policy for C should be the intersection of the full chain — not just what C's config says, but A's rules ∩ A→B grant ∩ B→C grant, computed at execution time. We don't have a design for that yet.

You've clearly worked on this at a level beyond what we've reached. How have you approached the intersection problem in practice — do you compute effective authority at execution time, or seal the intersection when the delegation grant is issued?

I wondered: does K9 actually do what its README claims? So I used K9 to audit K9. The README became the intent contract (Y*_t). 28 claims tested. Two failures:

1. k9_wrap_module silently skips functions on dynamically-constructed modules. Undocumented edge case. Severity 0.6.

2. Sensitive params are redacted as {_type, _hash, _length}, not [REDACTED] as documented. The implementation exceeded the documentation.

The interesting part: a unit test would just say FAIL. The CIEU record shows the direction of the divergence -- "implementation exceeded documentation" is a different finding than "implementation broke the rule."

Full case study with all 28 test results: https://github.com/liuhaotian2024-prog/K9Audit/blob/main/cha...

Comments URL: https://news.ycombinator.com/item?id=47412091

Points: 1

# Comments: 1

We recently had Case #001: a Claude Code agent got stuck in a 70-minute loop, repeatedly injecting a staging URL into a production config file. Raw logs showed "exit code 0" (all green).

To fix this, I built K9 Audit — a deterministic, non-LLM causal auditing layer. It drops directly into .claude/settings.json (zero code changes, perfectly compatible with GStack). It records a cryptographically hashed 5-tuple of what the agent did vs what it was supposed to do.

If you're using GStack to speed up, use K9 Audit as your seatbelt. Repo: https://github.com/liuhaotian2024-prog/K9Audit

The problem was invisible because nothing had recorded what the agent intended to do before it acted — only what it actually did.

K9 Audit fixes this with a causal five-tuple per agent step: - X_t: context (who acted, under what conditions) - U_t: action (what was executed) - Y*_t: intent contract (what it was supposed to do) - Y_t+1: actual outcome - R_t+1: deviation score (deterministic — no LLM, no tokens)

Records are SHA256 hash-chained. Tamper-evident. When something goes wrong, `k9log trace --last` gives root cause in under a second.

Works with Claude Code (zero-config hook), LangChain, AutoGen, CrewAI, or any Python agent via one decorator.

pip install k9audit-hook

Comments URL: https://news.ycombinator.com/item?id=47344702

Points: 5

# Comments: 3