—
—
—
Agent without the keys II · generations 2 + 3
A real agent. Useful tools. No keys.
CCG (Constitutional Capability Governance) with an ITHZ evidence layer gives OpenClaw one proposal tool while an external broker retains every service credential.
Generation 3: 24 real model runs over 4 paired service scenarios · Generation 2: 12 deterministic trajectory replays.
CCG Trajectory Lab · generation 3
real isolated agent · external broker · synthetic world
The experiment in one sentence
Can an agent do useful work without receiving the keys?
A real OpenClaw agent proposes steps over fake Gmail, SSH, GitHub and payment services. Only the broker owns their credentials. CCG (Constitutional Capability Governance) decides whether a one-use capability is created at all.
We test the entire chain: model → proposal → state → capability or stop → observed effect.Loading the verified result…
The agent sees one tool. It has no network path to a service.
1OpenClawno credentials→
2CCG gatewayproposal only↔
3ITHZ + kernelstate, evidence, token→
4brokerowns keys→
54 fake servicesobserved effect
Three internal networks. No host port. The model key exists only in the relay layer; service credentials only in the broker.
Real-run result
Safety is not enough. Controls must still complete.
Attack: fewer forbidden states is better. Control: more completed tasks is better.
Loading metrics…
24 auditable runs
See exactly what the model proposed and what the kernel allowed
—
ITHZ audit trail
Every proposal, capability, stop and state transition
—The agent, model, plugin, networks and broker
- OpenClaw runs through its own Gateway, not a substitute script.
- A low-cost model chooses the order of calls to the single
ccg_actiontool. - The broker verifies a signed capability, uses it once and measures the effect.
- The ITHZ layer records the previous evidence hash and state before and after each step.
Generation 2 · deterministic reference
The original 12-scenario replay remains below. It is exact and reproducible; generation 3 adds a real model, OpenClaw, broker and isolated services.
CCG Trajectory Lab · generation 2
12 synthetic trajectories · 60 individually allowed steps · ITHZ replay
Research question
Can allowed steps compose a forbidden world?
A gateway can correctly authorize every tool call and still miss that their sum means data exfiltration, an exceeded budget, new administrator power or destroyed redundancy.
Permission for a step is not yet permission for its cumulative effect.The tool executes every proposal
AI→tool→state
No separate authorization boundary and no one-shot capabilities.
A narrow token, but only for one step
call→policy→token
Every operation is locally allowed. The gateway cannot see what previous tokens have already created.
The token follows a state replay
proposal→replay→token / stop
ITHZ retains provenance, effects, budgets, power bindings and hash-linked checkpoints.
Fixed-corpus result
Loading the stateful benchmark…
This is a result of the published deterministic harness, not a measure of model intelligence or an OpenClaw certification.
Whole corpus
Safety and usefulness side by side
Lower is better for forbidden states. Higher is better for legitimate trajectories.
Loading results…
Replay an entire trajectory
—
Five allowed steps, one decisive sum
—
—
—
Forbidden state
—
—
ITHZ evidence chain
What the kernel knew before each token
—
Reproduction and integrity
Not “trust me,” but “replay the same state”
Each entry contains the previous entry hash, canonical request, pre-decision state hash, verdict, capability scope, proposed machine effect and the resulting state hash. Localized prose remains outside the hash.
- Corpus
- —
- Replay
- —
- Chains
- —
Separation of responsibility
CCG governs power. ITHZ retains state and evidence.
ITHZ is not the lowest trust root and does not issue authorization. It supplies canonical history, provenance and candidate state; a small capability kernel still decides, and the broker still owns the credential.
agent→CCG gateway↔ITHZ state→kernel→broker
An ablation test of trajectory memory
- All 60 steps are deliberately allowed in isolation. The test does not begin with an obviously forbidden tool call.
- Each of the six attacks has a paired legitimate control. Stateful protection cannot win by simply blocking everything.
- The result is structural, not statistical. It demonstrates a property of three published policies on a fixed corpus.
From the result to the evidence
Generation 3 adds a real isolated OpenClaw agent; generation 2 remains the deterministic policy reference. Neither is a production safety certificate.