What happens if the reasoning model hallucinates or is compromised (e.g. via prompt injection)?

A hallucinating or adversarially-manipulated model can still propose a bad remedy, but it cannot escalate what that remedy is allowed to do beyond what the static registry permits for the matched action type. The compiled signature is also admitted into a shadow execution state and must independently earn graduation through confirmed successful outcomes before it can ever execute autonomously, exactly like a human-authored signature.

Why is a tiered reasoner used instead of a single model?

A local model is tried first for cost and latency; the system escalates to a larger frontier model only if the local model abstains or errors. This tiering affects which model produces the candidate remedy, but does not change the registry-clamping step - authority is sourced from the registry identically regardless of which tier of reasoner proposed the remedy.

Agentic Signature Synthesis with Registry-Clamped Authority

Q: Can the reasoning model grant itself broader execution authority?

No. This is the central guarantee of the mechanism. When the reasoning model proposes a remedy, its proposal is matched against a static, pre-existing remediation-authority registry to determine the applicable blast-radius classification and execution scope. The model's own description of what it thinks it should be allowed to do is never consulted for that determination - authority always comes from the registry lookup, not from the model's output.

Executive Summary

The cortex layer of AEGIS's subsidiarity router (Claim 57) is reached when a fault occurs that no existing signature at the reflex or autonomic layers recognizes. At that point, an Investigator component assembles a PII-free evidence pack describing the fault and hands it to a tiered Reasoner: a local model is tried first, escalating to a larger frontier model only on abstention or error. The reasoner proposes a candidate remedy.

What happens next is the part that matters. The proposed remedy is matched against a fixed, pre-existing remediation-authority registry to determine what blast-radius tier and execution scope apply to that type of action. The reasoning model's own output - including anything it says about how safe, how scoped, or how urgent its proposed action is - is never consulted to determine that classification. Authority is a registry lookup, not a model claim. The resulting signature is compiled and admitted into a shadow execution state, where it must earn graduation through confirmed successful outcomes exactly as described in Claim 54, with no shortcut for having been authored by a model rather than a human.

Core Innovation: A generative reasoning model is allowed to author new autonomous-fleet remediation logic, while a structural guarantee - authority sourced from a static registry, never from the model's own output - ensures that a compromised, manipulated, or simply hallucinating reasoner cannot self-grant itself wider execution scope than the registry already permits for that action type.

Problem Statement

Letting a language model author operational automation is attractive because it can cover fault modes no engineer anticipated - and dangerous for the same reason. A model that both diagnoses a novel fault and describes how much authority its own fix should have creates a single point where a hallucination, a subtly wrong self-assessment, or a deliberately crafted adversarial input (for instance, injected through log or error text the model reads as part of its evidence pack) could talk its way into broader execution scope than the actual risk warrants.

70%

of outages Uptime Institute's annual survey attributes at least partly to human error or process failure

$9,000

widely-cited (Ponemon Institute) estimate of average cost per minute of unplanned downtime

Zero

execution-authority degrees of freedom given to model output - blast radius and scope are always registry-determined

Why Existing Solutions Are Insufficient

General-purpose LLM agent frameworks with tool access: Typically grant a tool call whatever scope the tool's own API allows, evaluated per invocation rather than gated by a separate authority registry independent of the model's request.
Prompt-based safety instructions ("only take low-risk actions"): Ask the model to self-police its own scope in natural language - exactly the self-assessment surface this mechanism deliberately refuses to trust.
Human-in-the-loop approval for every model-proposed action: Safe, but eliminates the latency and scale benefits of autonomous remediation for the very class of novel faults where a model's pattern-matching is most useful.
Sandboxed/dry-run-only model outputs: Prevents real-world harm entirely by never executing model-proposed actions, which also means the fault never actually gets fixed without a human converting the suggestion into action.

Technical Architecture

Evidence Assembly

An Investigator component builds a PII-free evidence pack describing the unrecognized fault - relevant logs, metrics, and system state - stripped of information that would expose sensitive data to the reasoning model.

Tiered Reasoning

The evidence pack is submitted to a local model first. Only on abstention (the local model declines to propose a remedy) or error does the system escalate to a larger, more capable frontier model. The reasoner's job is to propose a candidate remediation action, not to determine its own authority.

Registry-Clamped Authority Determination

The proposed candidate remediation is matched against a static remediation-authority registry - the same registry structure that governs the blast-radius classification described in Claim 55 - to determine the blast-radius tier and execution scope that applies. This lookup is entirely independent of the model's proposal text; the model has no mechanism to inject or influence a wider classification than the registry entry for the matched action type actually specifies.

Signature Compilation and Graduation

The matched remedy, bound to its registry-determined classification, is compiled into a new signature and admitted into the same shadow execution state described in Claim 54. It must accumulate confirmed successful outcomes and cross the same Bayesian confidence threshold before it can graduate to autonomous execution - there is no accelerated or discounted graduation path for model-authored signatures.

Registry-Clamped Authority Model

Step	Actor	Determines
1. Evidence assembly	Investigator	What the reasoner sees (PII-free fault context)
2. Candidate proposal	Tiered Reasoner (local, then frontier)	What action is proposed
3. Authority determination	Static remediation-authority registry	Blast-radius tier and execution scope - never the model
4. Signature compilation	System	Binds proposed action to registry-determined scope
5. Graduation	Confirmed-outcome confidence gate (Claim 54)	Whether the signature ever earns autonomous execution

Because the routing decision to reach cortex in the first place is itself governed by the subsidiarity router of Claim 57, and the resulting signature is subject to the same blast-radius constitution as any other signature under Claim 55, this mechanism does not introduce a separate, weaker authority track for model-authored remediations - it is the same authority system, with the model simply supplying the candidate action text rather than a human engineer.

Prior Art Differentiation

System	Model Proposes Action?	Model Determines Its Own Scope?	Independent Registry Clamp?
General LLM agent + tool-call frameworks	Yes	Often, via tool selection	Typically no
Prompt-based self-policing agents	Yes	Yes (natural-language self-assessment)	No
Human-approval-gated model suggestions	Yes	No (human decides)	N/A - no autonomous execution
JIL Sovereign AEGIS Cortex Layer	Yes	No, never	Yes, always

Patent Claim

Independent Claim 58: A computer-implemented method for synthesizing a machine-authored remediation signature while structurally bounding its execution authority, comprising: assembling an evidence record describing a diagnosed fault for which no existing remediation signature applies; submitting the evidence record to a tiered reasoning model that proposes a candidate remediation action; matching the proposed candidate remediation action against a static remediation-authority registry to determine an applicable blast-radius classification and execution scope, independent of any classification or scope proposed by the reasoning model itself; compiling the matched remediation into a new remediation signature bound to the registry-determined classification and scope; and admitting the new remediation signature into a shadow execution state subject to the same confirmed-outcome graduation requirement applied to remediation signatures not authored by the reasoning model.