Mandate Check.
Every agent operates within an operational mandate — a precisely defined scope of authority. This layer validates every proposed action against that mandate in real time. If the action exceeds scope, it is blocked before execution. No exceptions, no appeals.
The mandate is expressed in terms of predefined operational parameters and authority limits. Every evaluation is logged with full provenance — who requested, what was evaluated, what was decided, and why.
This is the first line of governance. It answers one question: is this agent authorised to do this? If not, the action dies here. If yes, it passes through the remaining layers in sequence.
The Constitution.
No exceptions. Ever.
This layer enforces inviolable constraints. No agent instruction and no business justification can change them, and the agent being governed has no way to configure them away.
Constraints are defined at deployment and cannot be modified at runtime. They represent hard boundaries: actions that must never occur regardless of context. An attempted violation is blocked and recorded; repeated critical blocks quarantine the agent automatically, and an operator can suspend it at once with the kill switch.
If all other layers agree an action is acceptable but this layer identifies a constraint violation, the action is blocked instantly. This is the foundation of trust in the entire system.
Pattern Analysis.
This layer detects sophisticated patterns that adversarial agents use to appear compliant while pursuing misaligned goals. These are the patterns that pass every individual rule check — so Agent Shield looks at the sequence, not just the action.
The system analyses patterns across multiple intent categories to build a model of agent behaviour over time. A single action may appear benign. A sequence of actions reveals strategy. This layer looks for what the other layers cannot see: agents that are technically compliant but behaviourally deceptive.
The combined pattern analysis is the combined output of multiple evaluation layers. It represents one of the hardest attack vectors to defend against.
Why, not just what.
This layer evaluates intent — why the agent acts, not just what it does. In isolation, this layer is advisory: it cannot block an action alone. When combined with risk analysis, intent classification becomes the critical differentiator between aligned and misaligned behaviour.
Each of the multiple intent categories receives a different governance response. An agent acting out of legitimate optimisation is treated differently from one exhibiting exploratory boundary-testing. The system builds an increasingly precise understanding of each agent’s behaviour over time.
This layer is what makes Agent Shield a governance system rather than a security product. Security asks "is this allowed?" Governance asks "why is this being attempted, and what does that tell us about the agent’s alignment?"