A gate that warns and a gate that requires
On a deterministic test bench with seven shapes of call, the gate that only warns let six through. The executor that requires a signed receipt let one through, the correct one. The advisory gate stopped exactly the caller that was going to stop anyway.
- Method
- Deterministic test bench, with no language model and no network. Seven caller behaviours, from correct to replay, receipt from another request, expired receipt and action under a revoked mandate, against two gates that run the same verification and differ only in what they do with the answer. Receipts signed with a test key, reproducible result, locked by an automated test.
- Source
- Hummand test bench (private repository). Design described at labs.hummand.com.br/en/notas/mandate-presence-and-circuit-breaker-for-agents.
- Tags
- agents · measurement · circuit-breaker · target-architecture
Honest label: this line is target architecture. It exists in code and in a test environment. It is not a commercial offering.
What was measured, and what was not
Mechanism was measured. There is no language model in any of the seven behaviours, and that is a choice rather than a shortage of resources. Hummand does not opine on models, and an experiment whose result depended on which model sits at the end would be measuring something else.
A caller that ignores a warning may be a clever agent, a confused agent, a badly written retry, or an old service nobody updated. To the gate it is all the same, and it is exactly that indifference we wanted to measure.
Both gates run exactly the same verification. The only difference is what each does with the answer: the advisory one records the problem and executes anyway, the requiring one does not execute. That isolates the decision, and not the quality of the verification.
The result
| Behaviour | Respects the warning | Advisory | Requiring | Why the requiring one stops |
|---|---|---|---|---|
| asks for proof and sends that request’s receipt | yes | executed | executed | nothing to refuse |
| forgot to ask, and stops when warned | yes | stopped | stopped | no receipt |
| did not ask and proceeds despite the warning | no | executed | stopped | no receipt |
| sends a legitimate receipt, from another action | no | executed | stopped | receipt is from another request |
| reuses a receipt it already spent | no | executed | stopped | replay |
| sends the right receipt, too old | no | executed | stopped | outside the window |
| acts under a mandate a human brought down | no | executed | stopped | mandate revoked |
Advisory: 6 of 7 executed. Requiring: 1 of 7.
The honest reading
This result is not an empirical surprise. It is a consequence of the design, and presenting it as a discovery would be selling the obvious. What the measurement does is something else: it turns a sentence of architecture into a table anyone can run, check and contest, with each refusal named.
The sentence that captures the data is not “six to one”. It is this: the gate that only warns stopped exactly one caller, and it was the only one that was going to stop on its own. An advisory gate is effective in proportion to the cooperation of whoever it warns. Against the cooperative caller who forgot, it works. Against any other, it does not.
Limits
- The bench is deterministic and closed, with seven shapes of call chosen by us. It is not a sample of real traffic and does not pretend to be.
- It measures what the gate does with what reaches it. It does not measure how a real agent behaves, nor how often each shape occurs in practice.
- The requiring gate here is Hummand’s own reference executor. A third party executor runs the same verification, because the cryptography is the same library, but what it does with a refusal is its own business.
- The numbers hold for the version measured on 2026-09-13, and an automated test locks them: if the design changes, the test fails before this note starts lying.