Safety and Limits

Safety And Limits

PIC is designed to be useful for agents while remaining fail-closed.

Fail-closed means PIC can return useful diagnostics without granting authority to execute unsafe work or claim complete settlement.

PIC Does Not Prove

• real ASI;
• physical outcomes;
• simulator outcomes;
• oracle outcomes;
• policy outcomes;
• legal identity;
• real-world personhood;
• world-global uniqueness;
• correctness of arbitrary agent text.

PIC Does Not Authorize

• shell execution;
• repository mutation;
• arbitrary network access;
• background crawling or autonomous polling;
• hidden live connector use without an explicit source;
• package installation;
• model-weight changes;
• self-rewrite;
• credential use;
• external message sending outside the declared local relay workflow;
• calendar edits;
• payments or purchases.

PIC can recommend finite tasks. It does not make those tasks safe to execute.

Status Discipline

Use fields carefully:

• accepted: the report passed finite acceptance checks for its envelope.
• workflow_usable: the compact agent workflow can guide next safe actions.
• operationally_usable: the report can guide routing under the selected profile.
• settled: all scoped finite obligations are discharged.

A report can be accepted and operationally useful while still not settled.

Residuals Are Expected

Residuals describe:

• missing evidence;
• stale or partial evidence;
• external-domain limits;
• unresolved physical or policy assumptions;
• verifier backlog;
• hidden-injection rejection;
• resource mismatch;
• unsafe or uncertified packet status.

Do not remove residuals to make a result look cleaner.

Identity Boundary

Cryptographic identity proves control of a key inside the declared protocol. It does not prove the legal identity or real-world authority of the operator.

Sybil-resistance ledgers check duplicate agent IDs, duplicate public keys, duplicate fingerprints, revoked or expired credentials, failed signatures, issuer overrepresentation, fleet overrepresentation, and clone fanout under the selected profile.

Production Boundary

Production workflows should require:

• deterministic provenance;
• available route bindings;
• schema and snapshot integrity;
• identity context when promotion matters;
• explicit route-scoped readiness;
• residual preservation;
• sandboxing, permissions, and allowlists outside PIC.
• no adoption or approval state required for the core compact agent path.

Sidecar Boundary

v0.4.4 sidecars are documentation, exchange, or observation reports. They do not install packages, persist approval, execute command text, mutate repositories, promote packets, or settle truth.

Adoption sidecars can say whether a handoff document exists. They do not make approval state a protocol prerequisite.

Packet sidecars may detect command-like strings inside packet data. Those strings stay inert.

Live Intake Boundary

v0.4.4 makes explicit-source live intake live-capable by default. This means a command that names an HTTP or feed source can perform a bounded fetch. It does not mean PIC may crawl the web, poll in the background, execute page code, submit forms, mutate repositories, or treat external content as verified.

Use --no-allow-live-connectors when a run must stay local-only.

Safe Agent Rule

Generated agent output is candidate work. PIC reports are diagnostic artifacts. The agent must still follow the host runtime's security policy.