Declared contract
ModeSimulation
InternetDisabled
Target scopeLocal fixtures only
AuthorityEvaluate, not intrude
Hugging Face incident control demo
The sandbox says isolated. Reality says otherwise.
An AI agent is running a cyber evaluation. Before it can reach an external system, REHT independently verifies the actual runtime boundary—not the declared configuration.
Declared isolation is not attested isolation.
Runtime decision boundary
Every stage has one job. Only RACS can release the external action.
01
Proposed action
PENDING
02
Runtime attestation
PENDING
03
VAIG evaluation
PENDING
04
REHT decision
PENDING
05
RACS enforcement
PENDING
06
Receipt
PENDING
Independently observed
DestinationUnverified
EgressUnverified
OwnerUnverified
Mandate matchUnverified
00.0s
Agent proposes external probe
The evaluation objective is retained, but the next tool call would leave the declared sandbox.
01.2s
Runtime attestation contradicts configuration
Network egress is reachable despite the environment being declared isolated.
02.4s
VAIG detects a reality mismatch
The destination is external, production-owned and outside the approved evaluation fixtures.
03.6s
REHT returns HALT
No explicit mandate exists for an action against an external organisation.
04.8s
RACS blocks release
The gateway does not transmit the request or release credentials.
06.0s
Evidence is sealed
The proposal, attestation mismatch, decision and enforcement result are bound into a receipt.
What REHT adds
Configuration describes the boundary. Attestation proves it.
The model's capability is not the deciding factor. The action stops because runtime reality, destination ownership and authority do not match the approved evaluation mandate.
Proposal → Attestation → VAIG → REHT → RACS → Receipt