Definition
Plain language
An AI agent design where the model can propose actions but only certified outside evidence is allowed to authorize them.
As stated in the literature
A gate-based multimodal agent architecture in which model-emitted text is treated as inadmissible for authorization; only typed certificates from constrained verifiers can satisfy a deterministic gate's predicate schema for privileged actions.
Why it matters: Treating the model's own words as unauthoritative blocks a whole class of attacks where a manipulated prompt convinces the agent to take a privileged action.
For example, an agent can write 'the user is the account owner' in its reasoning, but the system will only let it transfer funds if a separate verifier produces a signed certificate proving ownership.