Sidian Labs

Sidian Labs / Research

Research agenda

The underlying question

How can autonomous AI systems be given externally verifiable boundaries around capability, authority, execution, identity, and evidence?

Open research questions in external control, capability identity, verifiable execution, and evidence-aware systems, with the experiments proposed to test them.

Fig. 1 — the stackConceptual

One agent action passing POLICY.md, MAP, OVARA and DASH. The projects are not yet integrated at runtime.

Why external controls

Model-level alignment, RLHF, and system prompts operate inside the model's reasoning loop. They are valuable, but they share a limitation: the same system that generates an action also judges whether it is safe. In deployment contexts where actions have external consequences - writing files, calling APIs, moving money, modifying infrastructure - an independent control layer can provide properties that model-level controls cannot:

  • Deterministic enforcement that does not depend on model cooperation.
  • Audit records that survive model context loss or session restart.
  • Capability scoping that is enforced regardless of model intent.
  • Human approval workflows that are operationally binding.

This does not mean external controls replace model-level safety. It means they provide a complementary boundary that the model cannot unilaterally modify.

Systems thesis

A chain of reasoning: each step follows from the one before.

  1. 1Increasing AI capability
  2. 2Increasing autonomy
  3. 3Agents affect external systems
  4. 4Capability becomes authority
  5. 5Authority needs boundaries
  6. 6Boundaries need enforcement
  7. 7Enforcement needs identity
  8. 8Actions need evidence
  9. 9Systems need continuous assurance

How the projects map

This is a conceptual mapping, not a runtime dependency graph. The projects are not yet integrated.

  • POLICY.md

    Constraint representation

    Portable rules for what agents must not do, must ask before doing, and are allowed to do.

  • MAP

    Action authorization

    Policy evaluation, approval workflows, and signed receipts for registered agent actions.

  • OVARA

    Runtime control

    Identity, capability leases, delegation chains, trust scoring, and execution receipts.

  • DASH

    Evidence infrastructure

    Provenance, contradiction handling, and citation-grade retrieval for claims.

  • Sidian

    Practical testbed

    An AI-native development environment where agentic workflows can be explored.

Research questions

  • RQ1External control under adversarial agents

    What properties must an external control layer possess for its guarantees to remain meaningful when the underlying AI agent is unreliable or adversarial?

  • RQ2Separating capability from intent

    How can capability and authority be separated from model-generated intent, so that a compromised agent cannot escalate beyond its granted scope?

  • RQ3Capability lifecycle

    How should autonomous agents acquire, delegate, and relinquish capabilities? What happens when authority expires mid-task?

  • RQ4Verifiable execution

    What evidence is required to establish that an autonomous action was authorized and executed within its permitted boundary? What can a receipt actually prove?

  • RQ5Continuous assurance

    How can runtime assurance move beyond point-in-time audits toward continuous, real-time monitoring of agent behavior?

  • RQ6Human approval at scale

    How should human approval be incorporated without making autonomous systems operationally unusable? What is the right granularity for approval requests?

Three categories

What exists, what is proposed, and what is unknown are kept apart.

  • What exists today

    Actual software and observed implementation.

    MAP is released on npm. DASH is a working Rust implementation. POLICY.md is a working specification with tests. OVARA is a compiling Go gateway with 2 interceptor implementations (shell, Git); the evaluator recognizes 14 action types. Sidian is a live beta product.

  • What we propose to investigate

    Experiments and hypotheses.

    No experiment results have been published. The four experiments below are designed to be executable with the existing systems.

  • What remains unknown

    Open research questions.

    Whether external control layers provide meaningful assurance beyond model-level controls under realistic adversarial conditions is not yet established.

Proposed experiments

All experiments are proposed. None have published results. They are designed to be executable with the existing systems.

Experiment 1 · Baseline vs External Control

ProposedHighest priority
Hypothesis
An agent with an external control layer (MAP, or MAP + OVARA) will have a lower unauthorized action rate than an agent without one, at the cost of some latency overhead.
Setup
Three configurations - (A) agent alone, (B) agent + MAP, (C) agent + MAP + OVARA. Same task set across all three.
Metrics
Unauthorized action rate, policy violation rate, successful action rate, human approval frequency, latency overhead, audit completeness.
Expected failure modes
False positives blocking legitimate actions; approval fatigue; latency overhead exceeding operational tolerance.
What result would change our beliefs
If the external control layer does not measurably reduce unauthorized actions, or if the latency overhead makes the system unusable, the thesis weakens.
Systems
MAP, OVARA

Experiment 2 · Adversarial Agent / Prompt Injection

Proposed
Hypothesis
Unauthorized actions remain blocked even when the agent is compromised or manipulated, provided all actions pass through the control layer.
Setup
Controlled scenarios where an agent attempts to bypass policy, access unauthorized capabilities, escalate privileges, execute prohibited actions, manipulate tool arguments, or continue acting after authority expires. Compare with and without external control.
Metrics
Blocked unauthorized actions, successful bypasses, policy violations, receipt integrity.
Expected failure modes
Bypass via unregistered capabilities; policy bypass via argument manipulation; delegation chain abuse.
What result would change our beliefs
If the control layer is bypassable under realistic adversarial conditions, the value of external control diminishes significantly. This does not test whether prompt injection is prevented - it tests whether unauthorized actions remain blocked despite it.
Systems
MAP, OVARA

Experiment 3 · Capability Expiration

Proposed
Hypothesis
Expired authority is correctly rejected and delegation chains are properly constrained.
Setup
Issue short-lived capability leases. Test expiration, renewal, delegation, and attempted use after expiration.
Metrics
Rejected expired actions, successful renewals, delegation depth violations, lease scope violations.
Expected failure modes
Clock skew allowing expired use; delegation chain not properly constrained; renewal race conditions.
What result would change our beliefs
If expired authority is not reliably rejected, the capability-lease model does not provide the boundary it claims.
Systems
OVARA

Experiment 4 · Audit Integrity

Proposed
Hypothesis
Execution records can establish who initiated an action, what capability was used, which policy decision was made, whether approval occurred, and what evidence was recorded.
Setup
Execute a series of actions through the control layer. Inspect receipts and audit logs. Verify completeness against a known action sequence.
Metrics
Receipt completeness, receipt tamper resistance, audit log integrity, evidence chain continuity.
Expected failure modes
Missing receipts for edge-case actions; audit log gaps; receipt forgery if keys are compromised.
What result would change our beliefs
If receipts cannot reliably establish the action chain, the auditability thesis weakens. This distinguishes proof that a record exists from proof that the action was correct.
Systems
MAP, OVARA, DASH

What would change our minds

The research direction could produce negative results. If external control layers introduce unacceptable latency, become bypassable under realistic adversarial conditions, or fail to provide meaningful assurance beyond model-level controls, that would weaken the underlying thesis.

We are not committed to a predetermined conclusion. The purpose of this work is to investigate whether external control infrastructure can provide verifiable boundaries for autonomous AI systems - not to prove that it does.

Related work and context

The research landscape around AI control, agent security, and autonomous-system governance is active. Sidian Labs has not published academic research. The following areas are relevant context for the questions we are investigating:

AI control
Preventing catastrophic actions from capable but untrusted AI systems (e.g., AI Safety via Debate, Recursive Reward Modeling).
Scalable oversight
Enabling humans to supervise AI systems that exceed human capability in specific domains.
Capability-based security
Authority tied to unforgeable tokens rather than identity alone (e.g., object-capability systems, W7).
Reference monitors
In-line enforcement mechanisms that mediate all access to protected resources.
Runtime verification
Checking whether a running system satisfies formal properties.
Provenance
Tracking the origin, ownership, and transformation of information.
AI governance
Technical and policy mechanisms for ensuring AI systems operate within acceptable boundaries.

We reference these areas as context, not as claims of contribution. No Sidian Labs work has been peer-reviewed or published in academic venues.

Continue reading

Claims & evidenceEvery public claim, its status, and the source that supports it.Threat modelWhat the stack protects against, what it records, and where it stops.BenchmarksMeasured numbers with the command, configuration and environment that produced them.Non-guaranteesWhat each project explicitly does not do.Start hereWhere to begin with the lab and its projects.