Borrowed from avionics command-and-monitor architecture: the part that watches is never the part that acts. That separation is what lets BLOCK fire in milliseconds, independent of anything downstream.
Gray-failure detection over live telemetry. Computes the deviation integral and fires ALERT / LIMIT against the Safety Envelope, with zero coupling to execution.
Controlled fault injection and the deterministic kill-switch. On a LIMIT signal, BLOCK aborts within milliseconds and drives the agent to a Safe State.
Operational Deterministic Axioms sit exactly on the L3→L4 boundary: every composed action, the LLM reasoning plus the tool call it would trigger over REST APIs, MCP servers or A2A, passes through them before execution. This is where COM/MON becomes concrete, and the engine ships as a standalone module that composes with content filters and role-aware guardrails rather than replacing them.
| Layer | Subsystem | Core purpose |
|---|