The engine doesn’t issue the driver’s license.

Turn a red light green with evidence.

A thousand horsepower does not grant permission to enter a race. The same distinction matters for AI: intelligence and authority are different things. In his October 10 essay, Satya Nadella argues for separating the supply of intelligence from authority over it, with controls outside the model.

Our response is a concrete, limited demonstration. An agent can propose an action; an external governor decides whether it may execute. Execution alone does not unlock a completed status.

What the demonstration does

1. 1. Propose. A sandboxed agent requests a bounded artifact write.
2. 2. Authorize. Approval comes through the trusted operator. The agent cannot approve itself, impersonate another actor or access the signing key.
3. 3. Execute. The governor enforces the approved scope. Revocation and replay checks constrain subsequent actions.
4. 4. Verify. A separate read-only witness observes the artifact. A trusted host operator submits its receipt; the governor checks request identity and expected and observed content hashes before marking completion. False or missing evidence leaves completion withheld.

Verified in this build

35 behavioral tests passed. A fresh container run from clean commit 36fe77ad49851b87f98b434efd7343899ad1b9ad passed 24 of 24 boundary checks, including blocked self-approval, inaccessible protected resources, unauthorized writes, approval replay, revocation and false or missing witness evidence.

We also repaired a signing-key defect: keys are randomly generated and published without overwriting an existing key. Invalid keys and missing keys for an existing database fail closed instead of silently rotating identity.

Engineering evidence recorded October 11, 2026. These are project-run tests, not independent certification.

The boundary of the claim

This is a bounded prototype on a trusted host. The witness runs separately but shares that host; its receipt is not a signed attestation. A malicious trusted host or operator could forge evidence. Verification establishes the observed artifact at that moment, not its future integrity.

The checks do not establish production readiness, container escape resistance, universal AI safety or lifetime accounting of every downstream effect. Delegation and grant operations are outside this artifact completion contract. Those remain evaluation questions.

A red light turns green only for the specific issue the evidence resolves. Wider claims stay open.