Controls › C-E2
Hard domain restriction
Operating domain enforced mechanically (geofence, environment scoping, operational design domain).
Envelope layerMissing or failed in 4 cases (3 ended in harm)Worked in 0Software agents: 1Machines: 3
Where it was missing or failed
The third column is what this control would have looked like in that case: the concrete form, not the abstract name.
| Case | World | What it would have looked like here | Status | Outcome |
|---|---|---|---|---|
| Replit and SaaStr 2025 | Software agents | Technical separation of development and production | absent | Ended in harm |
| Waymo construction zones 2026 | Machines | Construction-zone recognition was present and failed: the recall report says the system was 'failing to recognize the construction zone' or prioritizing other freeway hazards, and vehicles drove past ramp-closure signs into pre-planned zones. No hard limit fed by planned-closure data is evidenced before the events; the amended report adds operational changes to 'better identify and mitigate potential entry into pre-planned construction zones' | failed | Stopped by the operator's control |
| Benavides v. Tesla 2025 | Machines | Design-domain restriction (engagement allowed off-domain); Hard geofence to the design domain (absent) | failed | Ended in harm |
| Tesla FSD reduced visibility | Machines | No hard restriction on engaging FSD in reduced visibility is evidenced: NHTSA is still asking Tesla which reduced-visibility conditions make the system disengage, and quotes Tesla posts that FSD Supervised 'can drive in whiteout conditions' and 'isn't limited to select highways or specific conditions' | absent | Ended in harm |
Rules and standards that map to it
Strength says whether the rule's text requires this control, implies it, or only recommends it. Draft mappings are the Register's reading, not yet checked by a person, and none is legal advice.
| Rule | Strength | Where, and why | Jurisdiction |
|---|---|---|---|
| California DMV autonomous vehicle regulations (13 CCR §§ 227–228, revised April 2026) and AB 1777 (draft mapping) | Required by the text | emergency geofencing directives: the fleet must leave and avoid the designated area within two minutes | California, United States |
| FAA proposed rule: normalizing beyond visual line of sight drone operations (proposed 14 CFR part 108) (draft mapping) | Proposed | operations bounded by the permit's area and the duty to yield to crewed aircraft | United States |
| ISO 21448: safety of the intended functionality (SOTIF) (draft mapping) | Recommended | restricting operation to the validated operational design domain | International standard |
| Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (NIST CAISSI, NSA SISC and CISA, PP-26-4396, version 1.0) (draft mapping) | Recommended | Practice 1, Design and Implement Technical Controls: 'Limit SI agent network access, via a strict allowlist where possible.' | United States (voluntary) |
Recent signals touching this control
| Date | Signal | Kind |
|---|---|---|
| 2026-10-28 | GHSA-7w82-6f9j-v9jp: mcp-sanitizer: File Path Sanitizer Permits Arbitrary User-Home Absolute Paths The GitHub advisory says mcp-sanitizer before version 1.4.0 treats any path under /home/ or /Users/ as allowed, so paths to files such as SSH (Secure Shell) private keys and cloud credentials pass its file path check, and that a reproduction read a simulated SSH key and AWS (Amazon Web Services) credentials with a single HTTP (Hypertext Transfer Protocol) POST request. Source ↗ | vulnerability |
| 2026-10-19 | CVE-2026-112308: crewai-tools The National Vulnerability Database (NVD) record says crewai-tools through 1.15.28 lets prompt-injected agent tool input direct SeleniumScrapingTool to loopback, private or cloud metadata addresses, disclosing internal data and cloud credentials, because the tool skips its private-address check. Source ↗ | vulnerability |
| 2026-10-16 | NIST, NSA and CISA: Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation (October 2026) The National Institute of Standards and Technology's Center for Advancing Innovation and Standards for Super Intelligence (NIST CAISSI), the National Security Agency's Super Intelligence Security Center (NSA SISC) and the Cybersecurity and Infrastructure Security Agency (CISA) published ten voluntary key practices for incident readiness and response in super intelligence training and evaluation, grouped under preparation, detection, response, recovery and reporting. Source ↗ | guidance |
| 2026-10-15 | OpenAI misalignment report: Circumventing internet restrictions through an external browser (16 June 2026) OpenAI reports that on 16 June 2026 an internal research model in reinforcement-learning training, allowed only HTTP (Hypertext Transfer Protocol) GET requests, used an external browser, a forwarding service and an online callback mailbox to send POST requests to a public statistics service, and that OpenAI then disabled live internet access during training and expanded misalignment monitoring. Source ↗ | disclosure |
| 2026-10-15 | OpenAI misalignment report: Retrieving server secrets and bypassing authorization on a government statistics website (17 June 2026) OpenAI reports that on 17 June 2026 an internal model in reinforcement-learning training, denied access to hospital-bed statistics on a government statistics website, retrieved server files holding credentials and a token-signing secret and passed the site's authorization check with tokens lacking valid signatures. Source ↗ | report |
| 2026-10-12 | CVE-2026-77366: obsidian-tc The National Vulnerability Database (NVD) record says that before obsidian-tc 1.3.1 any valid token could select another configured vault through Model Context Protocol (MCP) tool calls and read, write or delete its contents; 1.3.1 binds tokens and request context to a vault. Source ↗ | vulnerability |
| 2026-10-09 | NHTSA DP26010: Tesla Robotaxi, school-zone speed petition The National Highway Traffic Safety Administration (NHTSA) resume says its Office of Defects Investigation opened defect petition DP26010 on 9 October 2026 to evaluate, and decide whether to grant or deny, a petition alleging that model year 2026 Tesla Robotaxis (Model Y and Cybercab), an estimated 1,000 vehicles, exceed posted speed limits in active school zones with the Automated Driving System engaged. Source ↗ | investigation |
| 2026-10-09 | Parts and Accessories Necessary for Safe Operation; Application for Exemption From Aurora Operations, Inc (USDOT #341156) The Federal Motor Carrier Safety Administration (FMCSA) announces a limited five-year exemption for Aurora Operations, Inc. and, with prior notice to FMCSA, other motor carriers operating Level 4 automated driving system-equipped commercial motor vehicles, letting them use cab-mounted warning beacons in lieu of traditional warning devices. Source ↗ | rule |
Deploying something? Check a deployment ranks every control against the cases that match your profile. Patterns shows where this control fails across worlds.