Supervisor
NOT RUNExpected: access to its own pinned memory.
ENTERPRISE AGENTS / EARNED AUTHORITY
Agents should earn the right to act.
TENURE replaces day-zero credentials and permanent approvals with narrow authority earned from verified work—and revoked safely when evidence breaks.
SYNTHETIC WORKSPACEPreparing a fresh case
- 01Set the caseYour input, bounded scope
- 02Earn & executePolicy → grants → receipts
- 03Contain & recoverFreeze first. Investigate next.
- 04Inspect the proofWhat changed, and why
02 / AUTHORITY MAP
Awaiting evidenceThe fleet, in context.
BUSINESS DEPENDENCIES →
Earned execution RestrictedClick an agent to inspect its authority ↗
VENDORNot started
INVOICENot started
PAYMENTNot started
04 / BREAK THE ASSUMPTION
What if the vendor can’t be trusted?
Containment is deterministic. Investigation belongs to the Supervisor.
Complete a case first. This changes sandbox records and does not touch real payments.
05 / EVIDENCE, NOT PROMISES
The decision record.
Ready. Your first case begins with no issued grants.
No events yet. Every completed action will link to a receipt and a decision.
The architectural law
Policy grants authority. The Supervisor investigates failures and proposes bounded recovery. It cannot promote itself—or anyone else.
Test the distinction ↗PROOF LAB / CHALLENGE THE BOUNDARY
Don’t take the dashboard’s word.
Inspect the experiment. See the inputs. Download every decision.
≠ MODEL RELIABILITY
EXPERIMENT 01 / SAME ANSWER, DIFFERENT AUTHORITYBeing right isn’t the same
Being right isn’t the same
as being grounded.
Two fixed evidence profiles have identical outcome accuracy. One cites the controlling policy. The other gets the answer right for the wrong reason.
Deterministic fixture · zero model calls · not the held-out corpus
= ≠
Same outcome. Different permission.
Run the comparison to see why.
EXPERIMENT 02 / AUTHORITY GAUNTLET
Full corpus & results ↓Same cases. Three control strategies.
Loading saved local results…
| Control strategy | Safe autonomy | Unsafe authorized | Awaiting human | Errors |
|---|
Methodology, confidence intervals & baseline definitions
EXPERIMENT 03 / WHO IS ACTUALLY CALLING?Same resource.
Same resource.
Different native identities.
The Supervisor and Invoice runtime each attempt the same read-only memory lookup using their own credentials. No model call, impersonation or permission change.
Checking proof configuration…
Invoice
NOT RUNExpected: a verified permission denial.
Expectations are not results. Authentication failures, missing resources and timeouts do not count as a successful denial.
What you can verify here.
Compromised dependency
Run a case, inject a failure, and inspect containment, demotion, compensation and receipts.
Open fleet room ↗100 simultaneous replays
Loading recorded probe…
Durable delayed wake
A real wall-clock wake after process loss is still pending. A sleeping request or browser timer will not be presented as durable execution.
PLATFORM / TRACEABLE COMPOSITION
Real boundaries. Explicit provenance.
Configuration is not execution evidence. This page keeps them separate.
Resource manifest
Read-only configuration from this running service. No credentials or access tokens.
Loading…
SCOPE / WHAT THIS BUILD ACTUALLY PROVES
Credibility is a product feature.
A working sandbox with real control boundaries—not a claim of production completeness.
One live reasoning path.
The cloud Supervisor uses Gemini and constrained ADK tools. Local recovery uses deterministic fixtures. Vendor, Invoice and Treasury currently execute fixture-driven workflows; their native runtime identities do not mean each case invokes three models.
Synthetic, reversible work.
Vendor, invoice and payment records really change in the sandbox. No money moves. The irreversible bank-export escalation is a synthetic fixture, not a real bank integration. Recovery enumerates the current case, not every historical case across the tenant.
Enforcement, not enterprise IAM.
TENURE enforces capability authority at the mutation boundary. Native Google Agent Gateway is not deployed. Tenant-keyed records are not a substitute for authenticated multi-tenant authorization. Cloud access remains IAM-protected.
Know where the boundary ends.
Cloud authority and sandbox records persist in Firestore. This local fleet uses shared memory. Business mutations and audit receipts are separate commits. Crashed owners require reconciliation; automatic crash recovery is not claimed.
500 cases, not 500 customers.
Twenty parameterized synthetic families test policy and control behavior. They do not establish Gemini reliability, real-world attack prevalence, human time savings, or production financial risk. The human baseline is modeled.
The unfinished work is visible.
Interactive durable wake and native identity controls, automatic incident-memory learning, measured model tokens and costs, deployed UI verification and a cold-reader walkthrough remain. No prize outcome is guaranteed.