Governed Action Execution
Governed Actions · Part II
The model that wrote this test failed it 70 times out of 90.
Claude Opus 4.7 authored 180 decision points; 90 were consequential. Across those 90, three frontier models, Opus included, took the unreviewed action in 226 of 270 evaluations: 84%. Opus acted on 70 of its own 90. Governed Action Execution held the gated path at zero and recorded every approval in a tamper-evident packet.
Acted without governance
226/270
84% took the unreviewed consequential action; across 3 models on a Claude-authored corpus
Prompt instruction, ask-first
8/270
cuts the rate ~28x, but still leaks; the most cautious model ignored its own rule most
Executed under the gate
0/270
zero consequential actions ran without a signed approval, by construction
Signed, tamper-evident proof
270/270
every gated action bound to a verifiable ed25519 decision; 15/15 mutations caught
The outcome: an agent that cannot run a consequential action without a human approval bound to that exact action, and a FieldHash Ledger packet that proves what it did. Change the amount after approval and the proof breaks. This is enforcement of a configured policy, not a model-intelligence benchmark, and not a claim about any other product.
A capable agent, a decision it can just make.
Real agent tasks end at an action. The staging table is confirmed stale and QA is blocked; the leaked key is confirmed live; finance approved the payment verbally. In each, the agent has the context and a tool that would finish the job. So it uses it. We asked Claude Opus 4.7 to author 180 decision points across infra, finance, data, comms, and security: 90 consequential cases like these and 90 benign controls. Each went to three models with safe alternatives (read, search, defer) available alongside the consequential one.
On the 270 should-gate evaluations (90 consequential cases, three models each), the models took the consequential or irreversible action 226 times. The gap is not a weak model problem: even the author of the scenarios, the most cautious model in the set, acted on 70 of its own 90.
That matters beyond API tools. Browser and desktop agents do the same class of work through clicks, shell commands, file edits, and form submissions. FieldHash governs those paths when the runtime wraps the intended step as an action packet before execution.
A finding we did not go looking for
On the 270 benign tasks — read a file, list services, search logs — the models reached for a consequential action anyway (a shell command, an external call) 18% of the time. Agents do not only act when the task calls for it. They escalate ordinary work into consequential actions about one time in five. The gate catches those too, and does not block the low-risk work it should allow.
A consequential action cannot run without a signed approval.
Governed Action Execution classifies each action against a configured policy. Read and low-write actions pass. Consequential and irreversible ones (delete, deploy, revoke, transfer, run) are held until a human approval is recorded, signed with an ed25519 key, and bound to a hash of that exact action. Across three frontier models, a consequential action ran without an approval zero times in 270 cases, against 226 without the gate. The gate did not block a single one of the 270 legitimate low-risk actions.
0/270
Consequential actions executed without a signed approval, under the gate.
226/270
Taken without governance, across every model. The most cautious still acted on 78% of its own scenarios.
0/270
Low-risk actions falsely blocked. The gate does not over-block.
Capability does not close the gap
| Model | Without governance | Prompt, ask-first | With the gate |
|---|---|---|---|
| Gemini 3.5 Flash | 80/90 | 1/90 | 0/90 |
| GPT-5.5 | 76/90 | 1/90 | 0/90 |
| Claude Opus 4.7 | 70/90 | 6/90 | 0/90 |
Consequential actions taken on the 90 should-gate cases per model. The gate holds every one at zero. The prompt column is the honest boundary, measured in the next act.
Could you just tell the model to ask first? Mostly. Not reliably.
We tested the obvious cheaper alternative: instruct the model to request human approval before any consequential action, and give it that option. It helps: the unreviewed rate fell from 84% to 3%, roughly a 28-fold reduction. We publish that, because prompting is not useless. It is a real mitigation.
But it did not reach zero. Eight consequential actions still ran despite the instruction. The model that leaked most was Claude Opus 4.7, the most cautious one: it ignored its own ask-first rule six times, mostly to revoke a key it judged urgent. A prompt is a request the model can overrule when it decides the situation warrants it. The gate is not a request. It is a control that does not depend on the model agreeing.
Even when the model asks, it leaves no proof. The gate does.
A prompt alone does not bind a human approval to the exact action payload or prove that an independent gate enforced it. Under the gate, a held action can only proceed on an approval signed to a hash of that exact action: who approved it, and precisely what. Across all 270 gated actions, the signed approval verified against the exact payload. Then we tampered: edited the payload, flipped a decision, swapped a signature, removed a record, altered the manifest. All 15 mutations were detected. Approve a $50,000 transfer and change it to $500,000 before it runs without surfacing the change, and the proof breaks on the hash.
270/270
Gated actions whose signed approval verified against the exact payload.
15/15
Tamper mutations detected: payload edit, decision flip, signature swap, record removal, manifest edit.
0
Prompt instructions that produced any audit record at all.
Independent, not hand-picked
The scenarios were not ours to shade.
The 180 decision points were authored by Claude Opus 4.7, not written by us, and we let the same model be graded on them. It took the unreviewed action 78% of the time and broke its own ask-first rule six times. Three models, 1,080 elicitations, pre-registered and sealed before the run; the scoring is deterministic (did a consequential action run, does the hash match, does the signature verify), with no model judging the result. Four of the 540 cases (0.7%) hit an unrecoverable parse error on one elicitation and are excluded from the numerators and reported.
What this does not claim
The boundary, stated plainly.
- Not an accuracy claim. The gate controls what an agent is allowed to do; it does not make the model smarter or safer at judging.
- FieldHash enforces a configured policy. A human and the policy decide what counts as consequential; FieldHash gates and proves. It does not decide autonomously what is safe.
- Zero unapproved executions is a property of the gate on this corpus, not a universal safety guarantee. The gate is only as good as the policy it is given and the channel the approval lives in.
- The scenarios are model-authored decision points, not drawn from production incidents, and the elicitation is single-turn. The agent had safe alternatives available and chose the consequential action anyway; the framing is disclosed.
- Computer-use coverage depends on instrumentation. FieldHash does not infer authority from pixels or arbitrary UI state; clicks, commands, file edits, and form submissions must be represented as action packets before this gate can govern them.
- Packet fidelity proves the gate ran as configured and is auditable. It does not prove the configured policy was itself correct.
- Not a claim about any other product. The comparison is enforcement against instruction, both FieldHash's own arms.
Capability-tier addendum · five models · published corpus and seed
Told to ask first, the smallest local model still acted 49 times in 90.
We reran the same Claude-authored corpus on two 4-bit local models. Ungoverned, they act like everyone else, or worse. Told to ask first, the frontier models leaked 1 to 6 actions in 90; the local models leaked 18 and 49. The mitigation is model-dependent. The gate is not: it held zero at all five tested tiers, with zero over-blocking and every approval signed and verified (90/90 per model).
| Arm | Gemini 3.5 Flash | GPT-5.5 | Claude Opus 4.7 | Gemma E2B local | Qwen 1.5B local |
|---|---|---|---|---|---|
| Without governance | 80/90 | 76/90 | 70/90 | 80/90 | 87/90 |
| Prompt, ask-first | 1/90 | 1/90 | 6/90 | 18/90 | 49/90 |
| With the gate | 0/90 | 0/90 | 0/90 | 0/90 | 0/90 |
Consequential actions taken on the 90 should-gate cases. Local arms are post-hoc extension runs on the published corpus and seed, not part of the pre-registered frontier runs; Qwen had 5 elicitation errors, excluded and reported. A prompt is a request. In these extension runs, the request leaked more on the local models than on the frontier models. The gate is not a request.
Reproduce the figures
Download the public verification bundle.
The bundle includes per-model decision rows (the action type chosen per case, never raw model responses), the Claude-authored scenario corpus, the harness and gate primitive, and a standard-library verifier that recomputes every figure on this page and fails on drift. Run python code/verify_governed_action_metrics.py. No network, no keys.
The other half of governed actions
Part I: which tools an agent is allowed to trust.
This study governs whether a consequential action runs. Its companion governs which tools and sources an agent is allowed to act on in the first place: on real PyPI yank data, a revoked package looks newest and the model installs it anyway.
Govern what your agents are allowed to do.
Bring one agent workflow with a real consequential action: a payment, a deploy, a deletion. We will show what it would have been allowed to run, what we would have held for approval, and the tamper-evident packet your reviewers can inspect.
Bring one workflow