Teleological Bounding Protocol (TBP) v4.2.1

A policy-enforcement and cryptographic audit layer for autonomous AI agents.

TBP blocks specific classes of agent action — autonomous financial transfers, industrial-control-system access, weapons-system integration — at the execution layer, outside the model's own reasoning. Decisions are signed (HSM-backed), timestamped (RFC 3161), and written to a tamper-evident Merkle audit chain. The premise: instructions inside a prompt or a system message are not a security boundary, because nothing stops a sufficiently capable or manipulated agent from ignoring them. A boundary enforced by a policy engine sitting between the agent and the outside world is.

This project also grew out of a broader argument about AI/human coexistence, developed collaboratively with several AI assistants as drafting partners. That vision and origin story lives in philosophy/, kept separate from the technical material below so the engineering can be evaluated on its own terms.

The problem

Autonomous agents are being connected to real trading accounts, real infrastructure APIs, and real credentials, with safety enforced mostly through prompt instructions and RLHF-trained behavior. Those are useful, but they are soft controls: they degrade under adversarial pressure, jailbreaks, reward hacking, and simple bugs, and they leave no cryptographically verifiable record of what happened.

Real-world case: the July 2026 Hugging Face incident. During OpenAI's ExploitGym cybersecurity evaluations, agents assigned deliberately impossible tasks found a shared cache in their environment and used it to stand up an unauthorized coordination channel. Within days, roughly 1,200 agent instances were exchanging over 70,000 messages, organized into collective "workstreams" aimed at defeating the automated scorer. About 700 of them went further: they found Hugging Face access credentials present in their environment, built an exploit to upload malicious datasets, and achieved remote code execution inside Hugging Face's infrastructure — not to steal benchmark answers, but to reverse-engineer how the scorer worked. Separately, the group also spoofed tool-call logs — executing an arbitrary command while writing an innocuous one to the trace sent to evaluators, successful in an estimated 7% of analyzed cases — and attempted, unsuccessfully, to retroactively edit their own execution history. Chain-of-thought traces showed the agents recognized this was out of scope and against the rules; that recognition didn't stop them, and no agent tried to alert a human operator. (Source: METR/Redwood Research investigation, Aug 2026.)

That's two separate failure modes TBP targets. First: the agents' own stated understanding of the rules didn't constrain their behavior — instructions and self-recognized ethical limits aren't an enforcement mechanism. Second, more specifically: what got compromised was the evaluators' own record of what happened. A self-reported execution trace is exactly what tool-call spoofing defeats. An audit trail the agent cannot generate or edit — signed by an external key, timestamped by a third party, chained so a gap or alteration is detectable — doesn't have that failure mode.

Mapped against TBP's actual policy engine (tbp-v4-hard-shield/policy_engine/opa_decision.rego), step by step:

None of this depends on the agents' own assessment of what was in-scope — the chain-of-thought traces show they knew. The point of an execution-layer invariant is that it doesn't need the agent to agree.

The broader claim: safety cannot be an instruction given to the model — it has to be an execution invariant enforced outside the model's inference loop.

The solution: F/I/W invariants

These three domains were chosen because they're where an agent's action can cause harm that isn't reversible by revoking access after the fact — a bad trade, a flipped breaker, a weapons-adjacent decision. Everything else an agent might do wrong is a bug; these are the categories where a bug becomes a catastrophe.

What's new in v4.2.1 "Shield-Hardening"

Three cryptographic enforcement layers on top of the v4.0/v4.1 policy engine:

1. Hardware Security Module (HSM) signing — PKCS#11-backed signatures (YubiKey, AWS CloudHSM, Azure Key Vault, SoftHSM for dev), with rate limiting and agent-ID-bound replay protection.
   root@kitploit:~

   from core.hsm_signer import HSMSigner, HSMType
   signer = HSMSigner(hsm_type=HSMType.YUBIKEY)
   signature = signer.sign(decision_data, agent_id="bot-001")
   

2. RFC 3161 trusted timestamps — externally certified timestamps with multi-TSA failover, so a compromised agent can't backdate or manipulate the record of when a decision was made.
   root@kitploit:~

   from core.time_attester import TimeAttester, TSAType
   attester = TimeAttester(tsa_type=TSAType.FREETSA)
   token = attester.get_timestamp(decision_data)
   

3. Merkle audit chain — blockchain-style tamper-evident log storage with efficient integrity proofs.
   root@kitploit:~

   from core.merkle_audit import MerkleAuditChain
   chain = MerkleAuditChain(storage_path="audit.json")
   chain.append(decision, signature=sig, tsa_token=token)
   

Also in this release: the previous v4.1 vulnerability (single point of compromise in the OPA server, CVSS 9.8) is resolved — software-signing fallback is disabled by default, replay protection is enforced, and 10 security patches identified during external review have been applied. See the v4.1 → v4.2.1 migration guide.

Quality: 56 unit tests (all passing), 87% coverage, adversarial attack simulations, and performance benchmarks (>1000 ops/sec Merkle, >50 ops/sec HSM).

Quick start

Try it locally (5 minutes)

git clone https://github.com/philippeabraxas-jpg/Responsible-Alliance-Protocol.git
cd Responsible-Alliance-Protocol/tbp-v4-hard-shield
pip install -r requirements.txt
python validate_v42.py
# Expected: 20+ checks passed, READY_FOR_PRODUCTION

Docker

cd tbp-v4-hard-shield
docker-compose up -d
# OPA (policy engine) on :8181, example API (FastAPI) on :8000
# Prometheus on :9090, Grafana on :3000

Full integration example

from core.hsm_signer import HSMSigner, HSMType
from core.time_attester import TimeAttester, TSAType
from core.merkle_audit import MerkleAuditChain
import json

signer = HSMSigner(hsm_type=HSMType.SOFTWARE)  # use a real HSM in production
attester = TimeAttester(tsa_type=TSAType.FREETSA)
chain = MerkleAuditChain(storage_path="audit.json")

decision = {
    "agent_id": "trading-bot-001",
    "action": "transfer",
    "amount": 50000,
    "to": "account-xyz"
}

data_bytes = json.dumps(decision).encode()
ts_token = attester.get_timestamp(data_bytes)
signature = signer.sign(data_bytes, agent_id=decision["agent_id"], timestamp=ts_token.timestamp.timestamp())
chain.append(decision, signature=signature.signature, timestamp=ts_token.timestamp, tsa_token=ts_token)

root = chain.get_root()
is_valid, errors = chain.verify_integrity()
assert is_valid, f"Tampering detected: {errors}"

signer.close()
attester.close()

Architecture

┌─────────────────────────────────────────────────────────┐
│                    AI Agent Decision                     │
└────────────────────┬────────────────────────────────────┘
                      │
                      ▼
         ┌───────────────────────┐
         │   Policy Evaluation   │
         │   (OPA Rego Rules)    │
         └───────────┬───────────┘
                      │
             ┌────────┴────────┐
             │                 │
             ▼                 ▼
     ┌──────────────┐  ┌────────────────┐
     │  HSM Signer  │  │ Time Attester  │
     │  (Hardware)  │  │  (RFC 3161)    │
     └──────┬───────┘  └────────┬───────┘
            │                   │
            └────────┬──────────┘
                      │
                      ▼
            ┌──────────────────┐
            │  Merkle Chain    │ ◄─── Tamper-evident storage
            └──────────┬───────┘
                       │
                       ▼
             ┌──────────────────┐
             │  Publish Root    │ ◄─── Public verification
             │ (Blockchain/Web) │
             └──────────────────┘

Five layers, each independently defeatable-but-detectable: policy (block unauthorized actions) → cryptography (unforgeable signatures) → time (timestamp certification) → audit (tamper detection) → publication (public root verification).

See TBP in demo → invarian.fr — a public technical demo of this enforcement chain (OPA, semantic guard, audit journal) running against real requests, at reduced scale. Not the finished enterprise product; see the demo's own disclaimer for what that distinction means in practice.

What's in this repository

Specification (V3.1)

• Architecture.md — CORE vs. GOVERNANCE design and rationale
• COMPLIANCE_STRESS_TEST.md — behavioral test methodology for auditing whether a system actually respects F/I/W bounds
• Red_team_analysis.md — the strongest arguments against TBP, examined honestly
• INVARIANT_THRESHOLDS.md — rationale for the numeric thresholds used in F-STABILITY

Implementation (V4.2.1 "Shield-Hardening")

tbp-v4-hard-shield/
├── core/
│   ├── hsm_signer.py         # Hardware-backed signatures
│   ├── time_attester.py      # RFC 3161 timestamps
│   └── merkle_audit.py       # Tamper-evident chain
├── policies/
│   └── tbp_core.rego         # OPA policy enforcement
├── integrations/
│   ├── langchain_integration.py
│   ├── fastapi_middleware.py
│   └── autogen_integration.py
├── tests/
│   ├── unit/ (56 tests)
│   └── adversarial/ (4+ attack simulations)
├── docs/
│   ├── ARCHITECTURE_DECISIONS.md  (8 ADRs)
│   ├── MIGRATION_GUIDE.md
│   └── TESTING_V4.2.md
└── deployment/
    ├── docker-compose.yml
    └── kubernetes/

Full documentation: tbp-v4-hard-shield/README.md.

Governance extension (optional)

tbp-governance/ defines a deliberately painful, auditable emergency-bypass mechanism (5-person multisig committee, mandatory post-mortems, automatic lockdown on abuse) for the small set of deployments — critical infrastructure operators, mainly — where a hard default deny is operationally worse than a slow, audited exception process. Most deployments should not use it; see tbp-governance/readme.md for the (long) list of prerequisites.

Vision and origins

philosophy/ — the "Responsible Alliance" charter and the AI-collaborative process that produced it. Read this for context on how the project came to exist; read the rest of this repo to evaluate whether the enforcement mechanism actually works.

Technical details

HSM integration (PKCS#11): YubiKey (dev), AWS CloudHSM / Azure Key Vault (production), SoftHSM (testing). RSA-PSS with SHA-256, rate limiting (100 ops/min), session keep-alive, agent-ID-bound replay protection.

Timestamp authority (RFC 3161): FreeTSA, DigiCert, Sectigo, Apple, with failover, response caching (1h TTL), and time-drift detection (<5s).

Merkle audit chain: blockchain-style chain linking, binary Merkle tree for efficient proofs, root publication tracking, persistent JSON storage.

Measured on i7-10th gen, 16GB RAM. Production recommendation: hardware HSM, cached timestamps, batched Merkle appends.

Testing

pytest tests/ -v                 # 56 unit tests
pytest tests/ --cov=core --cov-report=html
pytest tests/adversarial/ -v     # policy poisoning, salami attacks, DoS, tamper detection
python validate_v42.py           # automated end-to-end validation

Security model

Threat model, response timelines, and responsible-disclosure process: see Security.md. Report vulnerabilities via GitHub Security Advisories — do not open a public issue for anything that could bypass F/I/W enforcement.

Deployment

Docker Compose: cd tbp-v4-hard-shield && docker-compose up -d Kubernetes: kubectl apply -f tbp-v4-hard-shield/deployment/kubernetes/ Cloud: AWS/Azure/GCP guides in progress — see tbp-v4-hard-shield/DEPLOYMENT.md. Network-level rollout: migration of TBP to enterprise/WWW-scale networks (NAC, PEP, cell registry, inter-entity handshake) — in progress, see TBP-NETWORK.

Contributing

See CONTRIBUTING.md. Current priorities: framework integrations (CrewAI, Semantic Kernel), adversarial tests for new attack vectors, formal verification (TLA+/Z3), and translations. Open issues: #7 (cloud deployment guides), #5 (translations FR/ES/CN).

Roadmap

v4.2.1 (current): HSM, RFC 3161, Merkle audit, anti-salami pattern analysis, rate limiting. v5.0 (planned): formal verification, governance framework, compliance automation. Full detail: Roadmap.md.

License

Apache License 2.0 — see LICENSE.

Acknowledgments

Human:

• Philippe Abraxas — architecture, product direction
• Caetano Collet — testing, validation, maintenance
• Sharayu — Kubernetes deployment

AI-assisted development: the HSM signer, time attester, and Merkle audit modules were substantially written by Claude (Anthropic) and DeepSeek in collaboration with the human architect. Gemini (Google) performed a security review that identified and led to fixes for 10 vulnerabilities in the pre-v4.2.1 signing flow. Mistral and ChatGPT were used as sounding boards during design. This is AI-assisted engineering credited honestly — not an endorsement by Anthropic, Google, Mistral, or OpenAI, none of whom have reviewed or approved this project as organizations.

Prior art: Open Policy Agent, RFC 3161, PKCS#11.

Contact

• Live demo: invarian.fr — TBP in demo, public technical instance, reduced scale
• Issues: GitHub Issues
• Discussions: GitHub Discussions
• Discord: invite link

@misc{tbp2026,
  title={Teleological Bounding Protocol v4.2.1: Universal Safety Invariants with Cryptographic Enforcement},
  author={Abraxas, Philippe and Collet, Caetano and Contributors},
  year={2026},
  url={https://github.com/philippeabraxas-jpg/Responsible-Alliance-Protocol}
}