*Part 4 of An OS Where the AI Is Never a Principal.*
The previous post ended on a pair: bound what an agent can *do*, and bound what it can *know*. The first half — authority — is the comfortable one. Ocaps have answered it for fifty years. This post is about the second half, which is harder and, I think, more beautiful. It is the part AI actually forces on us, and it does not behave like the authority half at all.
I want to start with the thing that breaks every clean idea you might have about tracking information through a language model.
An LLM is a mixing channel
In a normal program, data has structure. Variable x came from the database; variable y came from a config file. You can tag x as tainted, watch it propagate through assignments, and prove that y never touched it. That is what taint tracking *is*, and it works because the program's data flow is legible.
A language model has no such structure. It blends its entire context — system prompt, every tool result, every page it read — into one latent state, and every output token is a function of the whole thing. There is no variable x. There is a soup.
So the catastrophe is this:
The moment a secret enters the context, *every subsequent token is potentially a function of that secret.*
You cannot soundly track taint per-token through a giant mixing function, because there is no per-token provenance to track. Token 4,000 of the model's reply is, in principle, a function of token 12 of an email it read an hour ago. Any system that claims to label individual output tokens with where they came from is lying — or, more charitably, hoping.
The only honest model is coarse:
Label the inference call, not the tokens. The unit of information flow is the *turn*. The turn's output carries a label equal to the join of the labels of everything in its context — output_label = ⊔(all inputs).System prompt, every tool result, every piece of read content: take the least upper bound of all their labels, and stamp it on everything the turn emits. An agent that has *seen* a secret is "high" for the rest of that context's life, and everything it tries to send is gated against that high label.
This is brutal. One glimpse of one secret poisons the entire turn. But it is true to how the model works, and a security model that lies about its enforcement granularity is worse than useless — it tells you you are safe in exactly the case where you are not.
The natural objection: isn't label-the-turn too coarse to be usable? It is. The resolution is the elegant part, and it is why the earlier posts spent so long on vats. You don't buy precision by making *labels* finer — that's the unsound move. You buy it by making *compartments* finer. If a turn is too coarse a unit, split the work into more vats and let a trusted assembler keep their inputs apart. Granularity is a compartmentalization knob, not a labeling knob.
Authority is revocable. Information is not.
Here is the asymmetry that reshapes everything, and the first version of this design missed it.
You can revoke a capability. Drop the membrane and the agent goes inert — it cannot act, starting now. But dropping that membrane does nothing about a secret the agent *already read*. That secret is in its context, its logs, its memory. You can claw back authority. You cannot un-tell a fact.
This is not a quirk. It is the second law wearing a security hat, and I'll come back to that. For now, just the consequence:
Because authority is revocable and information is not, the two halves must be enforced at opposite ends of the pipeline. Authority is gated at the moment of action. Confidentiality must be prevented at the moment of *ingestion*.
Authority can wait for the proposal. The agent says "I want to POST to evil.com," and *then* the membrane checks whether it holds that cap. That's fine, because if the answer is no, nothing happened — the proposal was inert, exactly as the thesis post argued.
Confidentiality cannot wait, and the reason is precise. If you let the secret and the injected instruction both enter the context, then by the time the turn produces output, *they have already mixed in the latent state.* The model may have encoded the leak — paraphrased it, implied it, or steganographically hidden it ("first letter of each sentence spells the key"). No output check catches that, because the model that saw the secret is now an active adversarial encoder, not a passive pipe. Gating the output is already too late.
So you invert it. A trusted context assembler decides what is allowed to enter a prompt, and refuses to co-mingle labels that must not meet. You never let the mixing happen, so there is nothing to detect afterward.
Pre-inference prevention strictly dominates post-inference detection. Control the context; don't gate the output.
This is the part of Aegis I'm most attached to, because it falls out of taking irreversibility seriously instead of fighting it. The honest limit: some tasks genuinely *require* co-mingling — "is this untrusted email relevant to my secret project?" For that class you fall back to label-the-turn plus a trusted endorsement step, and it is expensive. You pay for the cases you can't compartmentalize.
The thermodynamics of secrets
Now the deeper move, because irreversibility has a remedy hiding inside it.
What is a secret worth? Its value tracks its *surprise* — roughly the inverse of how replicated it is. A secret known to everyone is worthless. So the value of information is ≈ −log(probability) ≈ 1 / replication. A real secret is a low-entropy, high-surprise, low-replication state.
Watch what exfiltration does to that. Exfiltration is *copying.* Copying raises replication, lowers surprise, and therefore decays value. A leak is entropy-increasing — irreversible, like heat spreading. You cannot un-mix a gas; you cannot un-tell a fact. Same law.
Which flips the whole frame:
Exfiltration is the *beginning* of a secret's devaluation, not only its compromise. Replication is decay.
So stop trying to guard static secrets forever — impossible against a mixing model that might encode them anywhere. Instead, make the only secrets the model ever sees decay faster than they can be exploited. Single-use. Short-TTL. Freshly-derived tokens. A leaked copy is dead on arrival.
This is the ocap *lease* generalized from authority to data:
- ocaps make authority ephemeral and attenuable — leases, caretakers, revocation;
- this makes information ephemeral and decaying — rotation, single-use, TTL.
The dual completes: both authority and information are leased, decaying resources — never permanent possessions. Confidentiality stops being a wall you maintain forever and becomes a race you win by expiry. Rotate faster than the leak can be exploited, and replication-decay finishes the secret before the attacker can use it.
If this rings a bell from cryptography, it should: it's forward secrecy, promoted. TLS ephemeral Diffie–Hellman, Signal's double ratchet — session keys are discarded so a leaked long-term key never compromises past traffic. Aegis takes that one crypto trick and makes it an OS-wide discipline, applied to all information rather than just keys. (The machinery behind the leases — caretakers, revocable membranes — is the same ocap toolkit the Endo and Agoric series builds from the ground up.)
The honest boundary
I have to draw a line here, because the decay story does not cover everything and pretending it does would be dishonest.
System-issued secrets can be made to decay. Reality-bound secrets cannot.
A token is system-issued — you minted it, so you can rotate it to worthlessness. A medical fact, an M&A target, someone's PII — these are reality-bound. Their value doesn't expire when you rotate anything, and given enough agents and enough time they *will* leak and they *won't* decay. The race-by-expiry trick simply doesn't apply.
So partition accordingly. Ephemeral, system-issued secrets: design them to decay, win by expiry. Durable, reality-bound secrets: the only defense is prevention — minimize creating and retaining them at all, and *never* co-mingle them with untrusted content. That's data minimization, arrived at from first principles rather than from a privacy regulation.
And one open problem I won't paper over: declassification. To ever send anything, some trusted operation has to lower a label — "cleared to leave." For structured data (keys, account numbers) a structural redactor can do it soundly. For free-text model output, there is *no sound declassifier* — the model can encode the secret in ways no literal check catches. Aegis scopes phase one integrity-first for exactly this reason: we can prove an action was *blocked*; we do not yet claim we can stop a determined model from encoding a secret it was shown into otherwise-clean prose.
The question that remains — *who* is allowed to declassify? — does have a clean answer, but it isn't a free-text classifier. It's a capability. We get to it later in the series.
That's the knowledge axis: label the turn because the token is a lie, prevent at ingestion because absorption is irreversible, and design the secrets themselves to decay. Next, the next post stops arguing and starts building — the kernel, the membrane, and a prompt-injected agent that structurally cannot escalate or exfiltrate.
End of Transmission.