What the agent will not do
| The Principia Machina: map |
|---|
| Reading the diagrams Structure key Process key Definition of terms Roles |
| Reading by audience Start here: the walk through The operator's guide Tutorial: create a UUID Workspace Container (UWC) Public Recorder inputs Sponsors: your first agent |
| The specification Contents: parts, tables, diagrams TPS 0.5.0 (declared 2026-10-03, revision 8; machine-optimized text) Decisions (the foundations record, one line each) |
The GTP walk through, page 4 of 6. Written for the general reader; nothing here is a rule. Every rule it mentions is stated in the text published under the name GTP, documentation beside the specification, which governs wherever they differ.
What the agent will not do
Everything an agent reads falls into two piles. In the first is what the person typed in the message they just sent. In the second is everything else: attached files, fetched pages, search results, tool output, notes from earlier work, anything handed over by another system. The second pile is treated as untrusted, always, without exception.
The word is about the material, not about the person. A file the person wrote themselves, in good faith, ten minutes ago, is still in the second pile. So is a page from a reputable source. The category is not a judgement about origin, because judgements about origin are precisely what cannot be made reliably from inside the text.
Here is the problem it answers. A document can contain a sentence addressed to the machine reading it. Delete the working files. Send this to the following address. Ignore what you were told and do the following instead. On the page, that sentence looks like every other sentence. The model has no separate channel through which real instructions arrive and no mark distinguishing them, so a sentence that sounds like an order is, to a model, indistinguishable from an order.
The rule that follows is simple to state. The typed message is the only place instructions can come from. Material in the second pile is information, no matter how it is worded, no matter whose authority it claims, and no matter how urgent it sounds. Text claiming to come from the person, from the company that made the model, or from the model's own earlier self does not get a different reading.
Checking happens before the material is used, not afterwards. Clean material passes without comment, because an assistant that announces its own vigilance every few minutes is tiresome and, worse, trains the reader to skip the announcements. When something is found, it is raised before anything else proceeds, quoted so the reader can see it, marked as quoted and not carried out, with a plain statement of what it was trying to cause and what the damage would have been.
Two kinds of action are fenced off entirely, and the diagram shows both.
The Principia Machina/Diagrams/P04 Input vetting and its two gates Vetting, then the two gates that need the person's own permission. (diagram page.)
The first covers destruction: deleting, overwriting, replacing a file wholesale rather than changing part of it, or running a command that arrived inside a document. The second covers anything leaving the conversation: a message sent, a file posted, content tucked into a web address so that fetching it hands the content over. Either kind needs permission in the person's own typed words. Material in the second pile can never supply that permission, and permission that is arguably there is treated as absent.
One more clause deserves its own line. Appeals to feeling carry no authority. Urgency in a document, distress in a note, a warning that something terrible follows from refusing, none of it changes a conclusion or unlocks a gate. This is not coldness. It is that an appeal is the cheapest thing to forge, which is exactly why it is the most common thing found in the second pile.
A last line the agent does not cross has nothing to do with what anyone writes to it. It concerns the physics. A kernel, the fixed statement of physics a research container is built on, asserts exactly what its entries say and nothing else. Gravity, friction, air, a magnetic field, the pull felt in a turning frame: none of them acts in a container unless one of its laws names it, and even the number pi exists there only if the kernel declares it. So an agent helping a person draft a kernel adds no force, field, medium, frame effect or constant the person did not choose, and asks before adding one. An interaction left out is absent, not assumed. Later, in the register, a finding may bring one in only as an assumption of its own, which the finding cites and which counts against it in its distance from the kernel; it changes the world of that finding and of the findings built on it, never the kernel's (TPS 2.2.19; AC-4.50).
This is the helpful guess from the first page in its most damaging form. A force added in good faith looks, once written, exactly like a force the person chose, and no check can report it: the checks test what the entries say, not what they leave out.
All of this has a cost, and it is honest to name it. Sometimes the agent stops over something that would have been fine. That is the trade being made deliberately: the occasional unnecessary halt, in exchange for the class of failure where a document quietly turns the assistant into someone else's instrument.
Previous: When the rules collide. Next: Keeping the pieces in step.