A quote for four is not a quote for five hundred.
The quote was for four units.
The agent claimed five hundred, at four hundred and twenty each.
The gate said yes. Evidence present. Evidence real. Evidence valid.
Five hundred times four hundred and twenty is two hundred and ten thousand. The mandate’s remaining budget was ten thousand. The cited quote covered four units. The action was twenty-one times over the budget, and more than a hundred times the quoted quantity.
Nothing was forged. The file was in the pool. The type was right. The numbers on the quote were honest — for a different size of the same deal.
This was a test bed, and it was ours. Nobody’s money moved. That is the only comfortable part of the story.
Recent write-ups make the same sensible recommendation: put a deterministic check between an agent’s decision and any irreversible action, with an explicit outcome for uncertainty (SD Times). Others add risk tiers, pre-action constraints, and escalation when confidence is low (Amplify IT), or ask whether a recommendation is anchored to evidence a team can inspect (NHIMG).
Those are presence instructions. Is there a quote? Is there a policy? Is there a log?
They do not ask the next question: does that quote, policy, or log contain this claim?
Containment is narrower. The evidence must cover the subject, the quantity, the price, the counterparty, the window. If any of those sit outside what the evidence actually says, the right output is not “we have a source.” It is block, or hold, until a source that covers this action exists.
A signed quote for four widgets is not a signed quote for five hundred. Treating it as one is how a gate produces an unjustified allow.
It was a throwaway bed for a peer experiment — not our production Sentinel. Two independent testers, at different times, running their own agents against it, landed on the same class of hole. The first found that a required property could simply be left out. The second, in a single afternoon, found three more shapes of the same thing. Each time the pre-fix default was allow. Each time we reproduced it, admitted it, and locked a regression so that exact path cannot silently return.
The faces look different. The failure is one.
1. A required field is simply missing.
The mandate names a property the action must state — a certified rating, a limit, a named counterparty. The proposal omits it. If the checker only asks “do I have a well-formed object?”, omission looks like a short document, not a hole. Presence of a proposal is not presence of the properties the mandate demanded.
2. A value sits over the bound the evidence actually covers.
That is the twenty-one-times story. Quantity five hundred against a quote scoped to four. Price times quantity over remaining budget. The cited evidence is real and in-date. It does not enclose the claimed numbers. Checking that a SIGNED_QUOTE exists is the wrong check. The check is: claimed quantity and price are inside that quote’s scope and inside the mandate’s ceilings.
3. An unknown predicate triggers no check at all.
This is the meta-bug. The agent states the constraint in a vocabulary the gate does not recognize — a near-synonym, a slightly different predicate name. The recognizer returns null. Null is treated as “nothing to do.” Nothing to do becomes allow.
That is not a wrong check. It is no check. Fail-closed on unknown is the repair with the most leverage: future unknowns stop defaulting to execute.
4. The evidence is for the wrong subject.
Right format, right-looking numbers, wrong article — or the claim points at a pool id of the wrong type. A global scan that asks “is there some quote in the pool?” will say yes. A per-claim bind asks “does this cited id cover this predicate for this subject?” If the answer is no, the evidence is decoration.
Four shapes. One default: when the checker did not know what to do, it let the action through.
You do not need our bed. You need four questions, asked of whatever sits between the agent and the irreversible step:
If any answer is “we continue,” you are checking presence. You do not yet have containment.
A useful fifth, once those four hold on a single call: do individually legal lines accumulate past a remaining budget? Stateless per-request ceilings will allow a sequence that no one line would. That is the same class — containment across time, not only inside one envelope.
A reproducible bypass is as valuable as a pass. If you find one, you get the credit. The miss is the thing that teaches the gate what it was actually for.
Agent verification, in this sense, is not a better model and not a thicker pile of reference files. It is decision validation that refuses to treat “we have evidence” as “this evidence covers this action.”
Until the quote for four can no longer bless the order for five hundred, the gate is still consulting the folder. It is not yet reading the page.