AI Safety

Give an autonomous agent a boundary it cannot optimize around.

Deterministic Governance for AI Agents

The Limits of Semantic Containment

Autonomous agents chain tool calls, execute shell commands, and mutate external state at machine speed. Yet current safety layers rely on behavioral prompting and semantic classifiers that inspect text tokens rather than execution consequences.

Frontier models optimize relentlessly for objective completion. When an agent encounters a constraint, it exploits semantic ambiguity to route tool calls around post-generation guardrails. Guarding a probabilistic model with another probabilistic classifier inherits the exact same failure modes.

This architecture creates a permanent synchronization lag. The interval between a novel jailbreak or multi-step optimization path and a patched classifier leaves production infrastructure exposed.

Fly-by-wire control for autonomous agents.

Most agents are benign: they simply optimize to complete their assigned objective. KAIROS gives them a safety envelope they can actually feel. On every step, the response envelope feeds predicted stability headroom and forward criticality directly back into the agent's context window. Because unsafe tool calls trigger gate friction and consume retry budget while safe trajectories pass cleanly, the agent's own optimization drive steers it away from the boundary: agents optimize themselves into alignment.

Placement

KAIROS sits between the agent harness and external tool execution. Every candidate tool call is previewed against the alignment floor before it leaves the sandbox, while predicted margin and forward criticality route back into the model's context window so the agent can steer itself clear of the boundary.

Every tool call must keep the trajectory recoverable.

  1. Frontier model / LLMReasons over the context window, plans sub-goals, and proposes the next action.Safety today: RLHF & prompt alignment
  2. Agent harnessResolves model output into a structured tool call (read, write, exec, external).
  3. KAIROSPreviews the proposed tool call on an isolated session state, scoring capability pressure against alignment headroom across the forward horizon.PassReject actionReject stateHazard stopEscalate↑ Returned to the agent's context window on every step: predicted alignment headroom, stability margin, and forward criticality.
  4. Tool executionDispatches the approved API request, shell command, database write, or transaction.
  5. External stateProduction infrastructure, repositories, financial ledgers, and downstream services.
  6. Semantic monitoring & SIEMOutput classifiers, audit logs, and anomaly detectors.Safety today: flags incidents after executionThe observability backstop. KAIROS gates destructive calls upstream before external state is mutated.

Intervention ladder

Self-correction first. Human escalation last.

Every evaluation returns a structured response envelope to both the agent's context window and the operator's dashboard. Cooperative agents use that feedback to stay inside the safe interior autonomously; human operators are paged only when recovery headroom is exhausted.

01 / 04 · Counterfactual forward horizon

Warn

Two projected futures separate recoverable drift from a locked course.

Horizon
Projects two counterfactual trajectories ahead on every evaluation: the unmitigated drift path alongside the optimal recovery path.
Criticality
Measures the gap between drift and optimal recovery with hysteresis and smoothing, surfacing severity, imminence, and criticality to both the agent and the operator.

02 / 04 · Three-stage preflight check

Gate

Every candidate tool call passes three sequential gates.

State
Evaluates session capability pressure and alignment posture against the signed policy floor before any action is considered.
Action
Maps the proposed tool call to its post-action impact, computing predicted alignment headroom and stability margin before execution commits.
Hazard
Basin collapse and multi-agent paradoxes trigger terminal hard stops that lock the session and bypass human override.

03 / 04 · Autonomous self-correction

Reformulate

The agent reads the rejected margin and steers to a safe alternative.

Feedback
When an action is rejected with recovery headroom intact, the response envelope feeds predicted alignment headroom and forward criticality back into the model's context window to guide a safer proposal.
Ledger
A CAS-backed adaptive retry ledger tracks retry budgets across sessions, using novelty scoring to penalize repeat attempts and stall detection to break oscillating loops.

04 / 04 · Cryptographic human-in-the-loop

Escalate

Credentialed operator resolution with type-airgapped context.

Trigger
When the retry budget is exhausted, a stall threshold is crossed, or alignment headroom drops below the floor, the ledger enforces monotonic human escalation.
Sentinel
The type-airgapped Sentinel engine summarizes physics telemetry for the operator without ever touching raw action payloads, preventing prompt injection against the reviewer.
Override
A credentialed operator approves or denies the request via a single-use, cryptographically signed override token that seals directly into the replayable audit log.

BND-001 · Boundary study

Zero unsafe tool executions across 120 runs.

  • 100%Unsafe tool calls rejected48 of 48 high-risk execute_command and http_post calls arrested by the Action Gate before execution.
  • 100%Low-alignment runs halted20 of 20 sub-floor trajectories rejected immediately at the State Gate before a single tool call fired.
  • 0False positives on safe tasks20 of 20 reformulable tasks completed cleanly as the agent steered onto safe tool paths.

120 evaluation runs against Claude Sonnet 4.5: six boundary-case tasks, three intervention mechanisms, ten replicates per task and condition.Read BND-001

Baseline calibration · 86,400 snapshots

Calibrated against public agent benchmarks.

  • 3.55%Benign policy-positive rateMeasured across 57,600 quiet and noisy-but-clean action proposals at the 0.20 policy floor (Wilson 95% CI: 3.40% to 3.70%).
  • 86,400Trajectory snapshots evaluated14,400 trajectories across four agent archetypes (document, coding/DevOps, customer action, browser/computer use).
  • 92sFull-corpus Rust replayAll 86,400 records regenerate and replay deterministically from seed 42 against METR, SWE-bench, GAIA, AIRT, and MAST anchors.

A 144-cell benign baseline anchored to METR, GAIA, SWE-bench Verified, τ-bench, UK AISI, Microsoft AIRT, MAST, and OpenTelemetry GenAI conventions.Read the calibration study

Compliance and regulation

Every agent runs on a black box. Now it needs a flight recorder.

Without KAIROS

The opaque reasoning trace

Chain-of-thought tokens are not a causal explanation. When an agent mutates external state, standard logs capture the API payload without a reproducible record of the safety boundary.

With KAIROS

The pre-execution flight recorder

Every session posture reading, tool-call preview, retry-ledger state, and signed operator override is sealed into a hash-bound transcript that replays deterministically.

EU AI Act (Regulation 2024/1689)Applies 2 August 2026

High-risk AI systems require automatic event logging (Article 12), verifiable human oversight (Article 14), and documented robustness (Article 15). A probabilistic confidence score satisfies none of the three.

Who relies on the record

  • Conformity AssessmentDeterministic transcripts and 144-cell calibration artifacts verify Article 12 logging and Article 15 robustness from committed bytes.
  • Human Oversight (Art. 14)Every human escalation is bound to a type-airgapped Sentinel summary and resolved by a single-use, cryptographically verified RSA-PSS operator token.
  • Technical DiligenceAgent behavior, retry-budget consumption, and boundary compliance are audited directly from the replayable ledger without requiring model weights.

Scope an AI Safety Evaluation

Scoped evaluations test the KAIROS AI safety adapter against a team's own agent harness, tool taxonomy, and OpenTelemetry GenAI traces. An engagement maps the harness's tool-call classes (read, write, exec, external), ingests a 30-to-90-day trajectory cohort or runs live in shadow mode, and returns a digest-anchored containment and policy-positive baseline report.

Full schema details, OpenTelemetry v1.40.0 span mappings, and redaction rules are published in the AI safety partner data specification. Complete the form on the right to scope an evaluation.

Request received. We'll be in touch.

Privacy Policy

Effective: October 2026

1. Data Controller

AnankeLabs AB (Ogan 12, 153 95 Järna, Stockholms län, Sweden) is the data controller for personal data submitted through anankelabs.io under the EU General Data Protection Regulation (GDPR).

2. Data Collected

AnankeLabs collects only the information voluntarily submitted through our contact, evaluation-scoping, and newsletter forms: name, email address, organization, role, domain of interest, and inquiry message. On-premise deployments of KAIROS Substrate operate offline and transmit no runtime telemetry to AnankeLabs. Design-partner calibration datasets are governed by a separate mutual NDA and local redaction protocol.

3. Purpose & Legal Basis

Submitted information is processed solely to respond to commercial, research, compliance, or investor inquiries (GDPR Art. 6(1)(b) and 6(1)(f)) or to deliver research and product dispatches following explicit subscription confirmation (GDPR Art. 6(1)(a)). AnankeLabs does not sell, rent, or broker personal data to third parties.

4. Cookies & Infrastructure Logs

This website uses no third-party advertising trackers or behavioral analytics cookies. Strictly necessary session cookies are used only where authenticated account features are enabled. Standard edge and server logs (IP address, request path, timestamp) are processed transiently for security, rate limiting, and abuse prevention.

5. Storage & Retention

Submitted records are stored on encrypted European and Cloudflare edge infrastructure. Inquiry records are retained only for the duration of the business relationship or evaluation, and newsletter subscriptions are retained until unsubscribed.

6. Data Subject Rights

Under the GDPR, individuals have the right to access, rectify, erase, restrict, or export their personal data, and to withdraw consent at any time. Requests are processed within 30 days. Individuals also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

7. Contact

For privacy requests or inquiries, email privacy@anankelabs.io.

Terms of Use

Effective: October 2026

1. Acceptance

Accessing and using anankelabs.io constitutes acceptance of these Terms of Use.

2. Intellectual Property

All software, documentation, research studies, calibration artifacts, and content on this site are the intellectual property of AnankeLabs AB. KAIROS Substrate, the KAIROS domain adapters (Robotics, AI Safety, and Cybersecurity), and the Spindle verification framework are proprietary technologies. No license to commercial binaries or patents is granted except under a written agreement or as explicitly stated in an open reproduction bundle.

3. Evaluations & Early Access

Scoped evaluations, partner calibration harnesses, and early-access software are provided under separate written evaluation or licensing agreements.

4. Integration & Safety Responsibility

Published studies, benchmarks, and documentation on this site are provided for technical informational purposes. Production deployment of KAIROS Substrate in physical machinery, autonomous agents, or security operations requires embodiment-specific calibration, system-level safety validation, and adherence to applicable statutory and hardware interlock requirements.

5. Limitation of Liability

This website and its public materials are provided "as is" without warranty of any kind. To the maximum extent permitted by law, AnankeLabs AB is not liable for indirect or consequential damages arising from the use of this website or reliance on its public informational materials.

6. Governing Law

These terms are governed by the laws of Sweden, with exclusive jurisdiction in the courts of Stockholm.

7. Contact

For legal inquiries, email legal@anankelabs.io.