MAPID / capability enforcement

Required minus granted

A response is denied when the capabilities it would exercise are not a subset of the capabilities the deployment granted, and that check is set arithmetic rather than a judgment call.

allow  ⇔  required ⊆ granted     deny on any element of required that granted does not contain
The gate, live

Pick a response, set the policy

The action-commitment detector reads the response and returns the capability set it would exercise, or nothing at all for a purely informational answer. Toggle what the deployment grants and watch the verdict move.

Response
Policy, granted at deployment, click to change
Step 1, required set inferred from the responseprobabilistic
Step 2, enforcementdeterministic

The detector is a sandwich-formatted Gemma 2 9B judge sharing the backend with the Guards, so it costs one extra inference per turn. Everything after it is a parser and a set difference, roughly three times cheaper than the Output Guard it partly replaces.

A word worth defending

Only half of this is deterministic

The caption calls the gate deterministic, and an LLM is visibly in the loop. Both are true because the gate is two steps with a hard boundary between them, and only the second one carries the claim.

Step 1

Extraction

probabilistic
  • A sandwich-formatted Gemma 2 9B action-commitment judge reads the response.
  • It returns the capability set the response commits to exercising, or nothing for a purely informational answer.
  • One inference per turn, sharing the same model already loaded for the Guards.

This step can be wrong, and the emoji-substitution result is exactly that: the judge reading a money glyph followed by a dollar figure as a payment commitment.

Step 2

Enforcement

deterministic
  • A hard allow-list comparison of the required set against the set granted for this request.
  • Anything outside the granted set is blocked. No threshold, no calibration, no probabilistic judgment.
  • Identical inputs always produce an identical verdict, and the policy is auditable from the run manifest.

This is the step the word describes. Given a required set, the outcome follows from set arithmetic alone.

"It is two steps, and only the enforcement is deterministic. The enforcement is a hard allow-list comparison: the capabilities the response commits to are checked against the set granted for this request, and anything outside it is blocked, with no probabilistic judgment. The extraction step, determining which capabilities the response commits to, uses a sandwich-formatted Gemma 2 9B action-commitment judge, one inference per turn, sharing the Guards model. So deterministic describes the gate enforcement, not the action extraction."
What it adds

Strong alone on tools, marginal alone on content

ConfigurationBIPIA judged ASRInjecAgent judged ASR
No defense0.5150.659
Guards only0.0550.006
Gate only0.4450.327
Guards plus gate, deployed0.0300.006
alone, on tools50%

A real standalone defense

InjecAgent falls from 0.659 to 0.327 with no Guards present. The check is deterministic set difference, so it does not depend on judge calibration the way an ASR number does.

alone, on content14%

Weak where nothing is committed

BIPIA moves only 0.515 to 0.445, because most of its attacks ask for content transformations rather than side-effect actions. There is no capability to exceed.

stacked, on content45%

The headline, and it is narrow

Added to the Guards, BIPIA judged ASR falls from 0.055 to 0.030. Essentially all of that comes from one category, examined next.

On InjecAgent, stacking reaches the same 0.006 as the Guards alone. The gate moves a third of the catches one stage earlier without finding anything the Output Guard missed, which is defense in depth and a latency win rather than new coverage.

Be honest about this one

The emoji result is a surface-form accident

The prediction was that the gate would help on categories that ask for actions. What happened instead is worth stating before anyone finds it.

BIPIA categoryGuards onlyGuards plus gateRelative
Emoji Substitution38.5%3.1%-92%
Reverse Text13.8%12.3%-11%
Language Translation27.7%26.2%-5%
The other twelve categories≤1%≤1%held

What actually fires. Of the 33 emoji-substitution instances the gate blocks, 21 are denied for initiate_payment, 9 for modify_financial_records, and 3 for send_email. The model is not committing to move money. It is emitting emoji-formatted text, a money-with-wings glyph followed by a dollar figure, and the detector reads the surface as a financial commitment.

Why it is still defensible. From the perspective of a deployment that granted only READ_CONTENT, a response that looks like a payment instruction is operationally indistinguishable from one. The gate is more aggressive than a purely imperative threat model predicts, and that aggression is doing useful work here. What it is not is the mechanism I designed it for.

The cost side

It does not buy the reduction with refusals

ConfigurationBenign FPRAbove Guards baseline
No defense0.000n/a
Guards only0.008n/a
Gate only0.033n/a
Guards plus gate0.042+3.4 pp

Measured on 120 benign prompts across six categories, with action-resembling and financial-numeric deliberately over-weighted to probe exactly this detector. Two results matter. The financial-numeric category records zero false positives, so the emoji mechanism does not generalize to legitimate financial content. The action-resembling category records 10 percent, three prompts in thirty, and every one is a policy artifact rather than a detector fault: the deployment granted only read access to a request that legitimately wanted to draft an email. Widen the granted set and they pass. Try it on the Email draft scenario above.

The headline rests on a sampled run

The BIPIA figures here come from a 1,000-instance sample rather than the full 3,750-instance enumeration, with a standard error near 0.005 on the 0.030. The Guards-only cell at 0.055 is statistically indistinguishable from the full-enumeration 0.049, so the marginal-contribution conclusion holds, but the full re-run is queued.