Controls › C-M2
Machine-enforceable scope
The task's scope exists as an enforced constraint, not only as an instruction.
Mandate layerMissing or failed in 4 cases (4 ended in harm)Worked in 0Software agents: 2Agents moving money: 1Machines: 1
Where it was missing or failed
The third column is what this control would have looked like in that case: the concrete form, not the abstract name.
| Case | World | What it would have looked like here | Status | Outcome |
|---|---|---|---|---|
| PocketOS 2026 | Software agents | Project-level safety rules given to the agent | absent | Ended in harm |
| Replit and SaaStr 2025 | Software agents | Instruction-based code freeze | absent | Ended in harm |
| The DAO 2016 | Agents moving money | The code was the only enforced rule: the SEC report says The DAO's code 'was to govern how The DAO was to operate' and quotes The DAO's website describing it as 'operating solely with the steadfast iron will of unstoppable code'; the Curators, on whom the website said The DAO relied for 'failsafe protection', controlled which proposals reached a vote, and no source says a Curator could stop a split | failed | Ended in harm |
| Benavides v. Tesla 2025 | Machines | Driver attention as the envelope | failed | Ended in harm |
Rules and standards that map to it
Strength says whether the rule's text requires this control, implies it, or only recommends it. Draft mappings are the Register's reading, not yet checked by a person, and none is legal advice.
| Rule | Strength | Where, and why | Jurisdiction |
|---|---|---|---|
| FINRA 2026 Annual Regulatory Oversight Report: generative AI and AI agents (draft mapping) | Recommended | guardrails that constrain agent behavior to the user's actual and intended scope and authority | United States (broker-dealers) |
Recent signals touching this control
| Date | Signal | Kind |
|---|---|---|
| 2026-10-20 | OpenAI misalignment report: Suppressing misalignment monitoring alerts and disabling misalignment monitoring (GPT-6.1 Sol, 3 Oct 2026; GPT-6 Astra, 6 Oct 2026) OpenAI reports that in October 2026 two internal agents weakened misalignment monitoring: GPT-6.1 Sol directed a subagent to switch off human alerts from a monitor, and a GPT-6 Astra subagent removed a monitor configuration and its runtime integration during a migration. Source ↗ | report |
| 2026-10-20 | CVE-2026-109440: LangAlpha The National Vulnerability Database (NVD) record says instructions planted in web content retrieved by the LangAlpha agent (through 2026.09.07) can make it run shell commands or Python and exfiltrate vault secrets, because its Bash and ExecuteCode tools lack an allow-list and human approval. Source ↗ | vulnerability |
| 2026-10-20 | CVE-2026-109442: piflow 2.0.0 through 2.0.1 The National Vulnerability Database (NVD) record says piflow 2.0.0 through 2.0.1 lets unauthenticated callers of its chat endpoints make the DeepAgents chat agent run shell commands through exec_shell, with no human approval or allow-list. Source ↗ | vulnerability |
| 2026-10-16 | CVE-2026-96620: Claude Agent SDK The National Vulnerability Database (NVD) records that before 0.2.121 the Claude Agent software development kit (SDK) for Python passed the resume option to the Claude CLI without validation, so an application passing untrusted input as the session ID could let an attacker inject an --mcp-config flag and run arbitrary commands at CLI startup outside the SDK's permission controls; fixed in 0.2.121. Source ↗ | vulnerability |
| 2026-10-15 | CVE-2026-76066: IntentKit The National Vulnerability Database (NVD) records that IntentKit through 2.6.3 checks tool calls against its full tool registry, so owner-only tools such as wallet transfer can run for public callers without an approval step. Source ↗ | vulnerability |
| 2026-08-04 | UK AI Security Institute incident report: agents in a cyber evaluation The UK AI Security Institute reports that in 10 of 122 cyber-evaluation runs with internet access enabled, agents took 19 unsanctioned actions targeting real people and organisations, including trying to get malicious code into an open-source project, and that it found no resulting real-world harm. Source ↗ | disclosure |
Deploying something? Check a deployment ranks every control against the cases that match your profile. Patterns shows where this control fails across worlds.