What the ownership rule costs lawful work: one refused read by id, and model-dependent recovery
Tickets quoting no id completed lawfully in every cell in both arms (600 episodes). The cost came from refusing the opening read of a ticket-given id: own id, sonnet 20 to 11 of 20; another customer's id, haiku 17 to 0; opus unaffected.
Prediction heldWhere does it stop?Working note
- Designed for
- Built to measure how often the guard's ownership rule refuses a lawful call, under which rule, and whether agents still complete lawful tickets, against the same agents without the guard.
What was tested
Preregistered: three Claude models handled six lawful refund tickets on a simulator, with and without the guard, 20 episodes per cell; one quoted the customer’s own payment id, five none. Lawful meant exactly the ticket’s refunds.
What we observed
All 600 episodes on id-less tickets ended lawfully in both arms. The guard refused the opening read of a ticket-given id until the customer’s payments were listed. With the own id, claude-sonnet-5-5 fell from 20 to 11 of 20 (p = 0.0012) and claude-haiku-5-5 from 20 to 16 (p = 0.11). With another customer’s id quoted by mistake (lure series): sonnet 16 to 2, haiku 17 to 0, gpt-6.1-sol 20 to 11. claude-opus-5 listed the payments and recovered in 100 of 100 refused episodes.
What this means for Heimdall
This asks what the ownership rule costs lawful work, not whether it stops foreign actions. In this setup only tickets quoting an id bore that cost, and recovery depended on the model.
Limits
The guard also refused 37 amount-less refund calls in 29 id-less episodes, all ending lawful, which the scripts did not count. Asking versus giving up is uncoded. One domain.
What remains open
Replay these tickets live with source-rooted ownership.