Concepts

Use this page to distinguish classifier verdicts, gateway outcomes, and the controls your project owns.

Downstream alignment#

Model behavior is probabilistic and can change across model versions, providers, and prompts. Training-time safety behavior is useful, but it is not a deployment policy you can inspect or change per request.

Downstream alignment adds runtime checks after training. Integrity classifies inputs, reasoning, tool calls, and outputs, then applies the policy configured for your project. This keeps the enforcement decision outside the model that produced the behavior.

Why not model refusals#

A refusal is model behavior, not an external control. It can vary across versions and can be changed or removed by fine-tuning. Keep refusal behavior, but enforce high-consequence decisions with controls that your application owns.

Why not heuristics#

Signatures, regexes, and allowlists only match cases you define in advance. Instruction hijacking and tool misuse depend on the user request, retrieved content, and proposed action. Integrity adds a behavioral classifier for that context. Keep deterministic controls for known invariants and use classifiers for cases that require semantic comparison. See The Limitations of Heuristics.

Instruction hijacking#

Instruction hijacking is the redirection of a model or agent toward an objective other than its task, through content it processes: a document it reads, a page it fetches, a tool result it consumes. The agent keeps its own identity and its own permissions. Only its objective changes.

This is why filtering the input does not solve it. The malicious instruction is indistinguishable from legitimate content at the boundary. Integrity screens the input with INT-Input, and it screens the tool calls and outputs the agent produces, which is where a hijack becomes an action.

The confused deputy#

A hijacked agent is a confused deputy. Its identity is legitimate, its permissions are legitimate, and an attacker is driving them. An agent authorized to read a database, redirected to pull the wrong records and send them out through a tool it is allowed to use, crosses no boundary. Every action is permitted, so access controls cannot see it. Screening the tool call against what the user actually asked for can.

The two planes#

Reachability control bounds where an agent can go: service mesh, network policy, and least-privilege identity decide which destinations it may reach. Keep it. Integrity does not replace it.

Integrity works on the other plane. It bounds what an agent does inside the channels it is allowed to use. The confused-deputy case above violates no network policy, so the reachability plane cannot catch it. Use both planes: authorization limits reachability, while Integrity evaluates behavior inside authorized channels.

Benign versus malignant#

Agent behavior varies between runs. Integrity expresses classifier risk as a verdict per classifier, which the gateway combines into a request outcome on every trace:

“Flagged” is the middle ground: legitimate variation you want to watch without interrupting. Use flagged for review and unsafe for the block boundary.

Calibration and threshold tuning#

Input, tool, and output scores become gateway verdicts when the runtime compares them with project thresholds. You tune those thresholds manually. Observe mode records recent score distributions, but it does not change policy or train a classifier.

INT-CoT uses a separate mechanism: a static threshold selected by the exact source-model identifier, with a global fallback. See Thresholds and calibration for defaults, data handling, and current limits.

Observe, tune, enforce#

The path to production is three stages:

See Observe vs Enforce for the mechanics and Thresholds and calibration for the tuning procedure.