What the guard costs, and how we measure

Overhead and data footprint of the guard that sits on the delegate's side, checks of its declarations, and the places where our own instruments, oracles and records misled us.

Where this stands

What the evidence shows 2

On one machine with a scripted model, the guard's own share was 25.0 ms per action, 15.3 ms of it the durable intent record, and under 0.5 ms per read; most per-turn cost was process start-up, about 65 ms per guarded turn. ENG-03 re-checked.
A marker census of the guard's own stores found 3 leak paths code reading had missed. After minimisation, the proxy's and gateway's intent records no longer held withheld values declared sensitive, and their logs held no provider refusal text. ENG-06 re-checked.

What did not hold, or was not unique 3

The guard did not save model spend: in the one resolvable contrast (n = 24), sessions with it cost 1.14 times those without (1.03 to 1.26), on different builds. Its case cannot rest on saved tokens. ARC-13 working note.
Our prediction that timing adds nothing failed: the uniform refusal text carried 0.000 bits about the reason on all 7 tools, but timing exceeded the permutation null in 3 of 3 runs, so uniform text alone does not close the side channel. ARC-15 working note.
Our own instruments misled us: a probe's alphabetical candidate slice hid a reachable hole, a 10-seed random control was unstable, and a published metric ranked two rule models opposite to a shared grid. These are instrument errors, not properties of the guard. ARC-12, ARC-10, ARC-09 working notes.

What remains open 2

Whether a live agent completes a documented guarded workflow is not shown: in 2 runs, setup defects held all 3 of 3 state-changing calls because no intent id was sent, and 0 end-to-end scenarios completed. ARC-17 re-checked.
Portability limits remain: the owner journal refuses any fractional number, the MCP proxy keeps only an answer's first text block, first-generation gateway refusals name the payment provider, and exact matching on a service's own field works directly in 5 of 9 documented services. POR-02, RRD-06 working notes.

Not yet published

18 of the 32 studies in this direction are not yet published: some draw on source material that cannot be published, others rest on records not yet in the repository.

Every published study on this question

2 Nov Measurement Working note
Can a service's own field decide whether a requirement applies? A documentation census of nine APIs
Per public documentation (2026-11-02), exact list matching on a service's own field works directly in 5 of 9 services, all on label or enumeration fields (6 of 9 without one assumed exclusion); 8 of 9 need a projection of a list of objects.
Where does it stop? Guard study
27 Oct Prediction held Re-checked
What a tool-call guard keeps about people: a marker census of its own stores
After minimisation, the proxy's and the gateway's intent records no longer held withheld values declared sensitive, and their logs held no provider refusal text; the census found 3 leak paths code reading had missed.
Where does it stop? Guard study
13 Oct Measurement Re-checked
What a separate guard process per agent turn costs: in-process vs fresh proxy vs long-lived session
Median turn latency, one turn at a time: 6.1 ms in-process, 120.7 ms with a fresh guard proxy per turn, 48.2 ms with a long-lived guard; the guard's own share was 25.0 ms per action and under 0.5 ms per read.
Where does it stop? Guard study
7 Oct Prediction failed Working note
A synthetic probe stand for customer-written declarations: the pre-written criterion failed, a revised one passed
Under the pre-written criterion, 23 of 25 mandatory rows were exercised and both declarations were blocked; 25 of 25 only under a criterion revised after the first run, which added an owner control and a path-binding check.
How we measure. Guard study
28 Sept Measurement Working note
Where the guard's code still assumes money or a number shape
Three assumptions remain in current code: a declared unit rendered under a money type name, which does not block a non-money declaration; journal refusal of any fractional number; only the first text block of an MCP answer kept.
Where does it stop? Guard study
7 Sept Measurement Re-checked
A documented live path blocked at the estimate step: an incident report
In 2 live runs 0 end-to-end scenarios completed: all 3 state-changing calls were held for approval because no intent id was sent, 5 reads succeeded, and the recovery scenario was never run.
Where does it stop? Guard study
3 Sept Mixed result Working note
What an agent learns from a refusal over stdio: body versus timing
The refusal text carried 0.000 bits about the reason on all 7 tools, but the largest per-cell timing estimate (0.395 to 0.637 bits) exceeded the permutation null (0.214 to 0.281) in 3 of 3 runs, refuting the timing prediction.
Where does it stop? Guard study
1 Sept Prediction failed Working note
The guard did not save model spend: a cost reading of 317 saved sessions
In the one resolvable contrast (n = 24), sessions with the guard on cost 1.14 times those with it off (1.03 to 1.26), on different builds; ablation arms showed no resolvable difference, and no saving was found.
Where does it stop? Guard study
31 Aug Measurement Working note
An instrument's candidate-selection rule hid a reachable hole
Replacing an alphabetical first-N slice with a capped selection rule exposed 1 reachable hole in the legacy refund variant, with a printed witness; the production model still showed 0 findings and 0 of 97 grid holes.
How we measure. Method
29 Aug Prediction failed Working note
A common denominator inverts a published model ordering
The premise of different denominators failed: they were identical. On a 654-key shared grid, production and legacy had 0 holes, the other two 654 of 654; the published metric ranked legacy below typed-only (93.58% vs 94.86%).
How we measure. Method
29 Aug Mixed result Working note
A proposed field adds no separation over the existing fence: a separability census
On a 96-cell synthetic grid the candidate field partitioned objects exactly as the existing fence (symmetric difference 0); 12 of 12 thresholds and 6 of 8 predictions held; 12 of 96 cells were reachable.
Better than simpler options? Method
26 Aug Mixed result Working note
A published metric cell with zero holes and a class it cannot see
The production rule model had 0 holes in the 545-key published cell yet, like the other three, admitted 14 of 14 unlawful actions of a class outside its construction; on an access domain the blind zone was empty.
How we measure. Method
26 Aug Prediction failed Working note
A 10-seed label-permutation control is unreliable; an exact replacement
With 1,000 seeds, 5 of 12 blocks were only conditionally certified (1 or 2 expected); an exact criterion changed 0 of 12 verdicts but took 13.897 s against 0.019 s, refuting the prediction that cost would not rise.
How we measure. Method
21 Aug Prediction failed Working note
Which binding axis carries protection depends on the action: a synthetic second-domain probe
It did not reproduce: on the invoices payment action the typing axis contributed 15.38 points (0 on refunds) and provenance 2.82, with 0 of 3,696 false positives; on an anchor-referencing close action all four variants tied.
Does it work? Method