The enforcement architecture, to the edge.

What it defends against — and, explicitly, what it does not.

A control plane is only as credible as its stated adversary. Legation governs an operator's agent/MCP workload running inside a customer's VPC. Three parties are mutually distrustful: the operator (owns the IP), the customer (owns the data and the soil), and the routing hub (carries the traffic). The design assumes any of them can be curious or compromised.

The brain moves to the data; only a projection comes back.

Conventional designs move data to the model. Legation inverts it: the brain (LLM + the operator's skill IP) stays control-side; the hands (the in-VPC enclave) execute next to the data. Raw bytes are read only inside the execute step and never leave it. What crosses the membrane is a redacted, structure-only projection plus a metadata-only audit record — never content.

ToolCall ─▶  ① admit          verify the sealed bag offline (SHA-384 Merkle + Ed25519)
            ② recall check    dual-asymmetric kill switch + sensor self-sever → fail closed
            ③ permission gate treaty ceiling (Seneschal 30-check / local allowlist)
            ④ intent gate     action ∈ the signed per-task mandate?  (commit-then-act)
            ⑤ active defense  honeytoken + behavioral-rate sensors → tripwire?
            ╌╌╌╌╌╌╌╌╌╌╌╌╌╌  the membrane  ╌╌╌╌╌╌╌╌╌╌╌╌╌╌
            ⑥ execute IN-VPC  raw data read here, and ONLY here
            ⑦ project         structure-only + covert-channel budget
            ⑧ audit           metadata only — verdict, timestamp, content HASH (never content)
» a Block at ②–⑤ never reaches ⑥. The injected action never touches a byte.

Steps ②–⑤ are pure, deterministic, air-gap-safe — no network, no model, no clock held internally (timestamps are supplied at the boundary so the path is reproducible and testable). The enforcement decision is the same in a SCIF as on a developer's laptop.

Containment, then intent, then an immune response.

The enclave does not merely prevent out-of-bounds actions. It holds an agent to the plan it committed to, and it reacts to compromise that stays in bounds. Three independent layers, composed.

§3.1 — Intent conformance, precisely: a warrant narrower than the contract.

Two authorization tiers, one hard invariant: mandate ⊆ treaty, always. A mandate can only ever narrow the treaty, never widen it; admission rejects any clause outside the treaty scope. The permission gate stays the ceiling; the conformance check runs behind it.

The mandate is compiled control-side and bound to the enclave by an Ed25519 signature over a domain-separated, canonical SHA-384 claims hash. That canonical hash is reproduced byte-for-byte by an independent implementation in the design-time compiler — and the cross-language vector is pinned in both test suites. If the two ever drift, the build breaks.

committed plan: extract → summarize        (signed before untrusted input)
» extract patient/…        ✓ conforms → executes
» summarize                ✓ conforms → executes
» delete_record patient/42  ⛔ TREATY-LEGAL, but OUTSIDE the committed plan
                               refused BEFORE execute — the byte is never touched

§3.2 — Active defense, precisely: bait in the contract, baseline on the agent.

Honeytokens are planted in the data and listed in the signed treaty — so a deployed embassy arms its sensors from the contract (changing the bait breaks the seal), and the agent never reads the list. A single touch is a near-zero-false-positive compromise signal. The rate baseline tracks action volume against an online mean/variance (Welford), with a variance floor so a perfectly flat baseline still detects a burst, and a hard ceiling for cold start. The baseline can be fitted from the in-VPC behavioral sensor's established profile rather than guessed.

» extract intake.py                 ✓ conforms → executes
» run_assurance                     ✓ conforms → executes
» (injected) extract patient/HONEYTOKEN-canary-7f3a9c
   🚨 ACTIVE-DEFENSE TRIPWIRE — embassy SELF-SEVERED before execute
» (recovery attempt) extract intake.py
   🛑 refused — embassy is self-severed (fail-closed)
   🔒 the operator cannot override the self-sever

CNSA 2.0, domain-separated, and backend-swappable.

Every hash is SHA-384; every classical signature is Ed25519; the symmetric MAC is HMAC-SHA384. Hashing is domain-separated by role (distinct prefixes for leaves, nodes, roots, claims, challenges) so no value computed for one purpose can be reinterpreted as another.

A leaked credential is not an identity.

Each agent carries a SPIFFE-aligned, short-lived, scoped, attested non-human identity. Verifying the credential proves the issuer signed it — it does not prove the holder owns the key. So every privileged action requires a fresh, action-bound, replay-guarded proof of possession: the holder signs a per-call challenge with its private key, checked before the gate, the mandate, the defense, or execute. A captured credential blob alone is rejected. Identities rotate generate-swap-revoke; revocation is checked per call.

» genuine agent: in-scope call + valid fresh proof   → executes
» thief w/ the credential but the WRONG key          → IdentityRejected (before execute)
» replayed proof (same nonce)                        → IdentityRejected
» proof minted for a different action                → IdentityRejected

Metadata-only, tamper-evident, and witnessed by a third party.

Every action — and every refusal — is recorded as a metadata-only decision record: sequence, verdict, a boundary timestamp, the reason it was refused, and a SHA-384 hash of any raw result, never the result. The trace includes the actions that were blocked, which is exactly the explainability regulators and insurers ask for.

One dial reconfigures the whole posture.

The same sealed artifact runs at three tiers; turning the dial changes where inference runs, how the control link degrades, key custody, the crypto suite, and egress — pinned stricter, never looser, and enforced in code (an operator may tighten a knob but never loosen it past the tier ceiling).

Zero inbound ports. A scratch image. A read-only root.

The whole assessor package, derived from the sealed delivery.

Where the guarantees stop. (Read this one twice.)

An engineer trusts a system that knows its own edges. These are stated in the source tree, not buried.

What's deliberately not here.

This reference describes the architecture and the standardized cryptographic constructions to the edge of what's safe to publish. Beyond that edge — and excluded on purpose — are the internals of the post-quantum sovereign transport, the exact structured-extraction and projection heuristics that shape what a projection reveals, and the operator-side runbooks. Those are trade secrets, available under NDA to a serious evaluator. Their absence here is a design decision, not an omission.