Proven Action. Power and Control over AI Agents: Strategy 2027–2035 (original title: «Доказанное действие. Власть и контроль над ИИ-агентами: стратегия 2027–2035»)
The cybernetics of governing autonomous AI: the MITR gate and the INDRA tester as a software answer that can be checked in code.
Alexander Fischuk · ANO Scientific Research Institute of System Synthesis · 2026 · in Russian · e-book on LitRes; full PDF edition, 850 pages · the figures about the MITR gate were checked against the instrument on the server on 14 October 2026 (method ADR-0282).
The book is in Russian. There is no English edition; this page describes the Russian edition.
Three ways to get the book
- Architectural memorandum: PDF, 41 pages, no registration. The formulas of all chapters, chapter 1 in full and Appendix B with the commands for independent replay. In Russian. Download the memorandum (PDF)
- Full copy for an organization: PDF, 850 pages, on request through the contacts page (in Russian). The copy is personalised: every page carries the issue number and the recipient’s address. The institute decides on each request.
- E-book on LitRes: fb2, epub, pdf, for phones and e-readers. Buy on LitRes
About the book
AI agents already pay, edit code, write to customers and delete data on a company’s behalf, faster than a person can click “Approve”. Who actually controls such an agent, and who will answer to shareholders and the insurer when it makes a mistake? The book is written for owners and chief executives. It covers the years 2027–2035 along five axes (model speed, energy, the internet of agents, labour, the state) and sets out a strategy that holds under any of three scenarios: the human signs the rule, not every action. The cybernetics of Ashby and Beer explains why an “Approve” button and a supervising neural network cannot hold agents in check. The answer is carried through to code. This is IS 3.0, the security of actions rather than text: the MITR gate checks an agent’s call against a rule in a fraction of a millisecond and issues a receipt that an auditor or insurer can re-verify without trusting the server’s owner; the INDRA tester is being built as a continuous penetration test. Every claim is labelled: measured, being built, plan, forecast.
Who it is for
- Owners and chief executives: who answers to shareholders, the insurer and the regulator when an agent errs, and how to keep control without signing off every action.
- Heads of IT and information security: why manual approval and a second neural network cannot hold agents in check, and what to put in their place.
- Lawyers and insurers: director liability, AI risk exclusions in policies, the 2026 rules of Russia, the EU and China.
A book as an instrument
Every claim is labelled MEASURED, BEING BUILT, PLAN or FORECAST. A measured claim names its instrument and date; a forecast names a benchmark by which it can be refuted. Measurements of 14 October 2026:
- a gate decision under a rule: 0.95 ms (median, 19 contracts);
- replay of the receipt chain: 4,958 decisions out of 4,958 matched, 0 discrepancies;
- attack set on actions: 62 cases, 0 attacks missed, 0 false refusals.
The book also says what does not exist yet. As of 14 October, one class of actions (file deletion) runs in enforce mode, and the others run in advisory mode. No outside verifier has replayed the chain yet. How to check it yourself is described on the page Independent verification protocol.
Contents and chapter formulas
Each chapter opens with a formula: one or two sentences that compress its conclusion. The nineteen formulas can be read in a few minutes and give the book’s whole coordinate system.
Introduction. Calibrating the instrument: the human, the company and the state at the intersection of two lines When the number of machine actions per unit of time exceeds the biological throughput of human attention, holding complex systems together requires moving control from thought to action, from action to rule, and from trust to a cryptographic receipt.
Part I. Map 2026 → 2035
Chapter 1. Speed: the exponent of computation, the falling cost of a token and the horizon of autonomous action The speed at which machine decisions are generated grows exponentially, while the throughput of human attention remains a biological constant. Where these curves diverge, manual approval of actions turns into a legal fiction, and the only stable control loop is a deterministic check of the rule before the action is taken.
Chapter 2. Energy and silicon: gigawatts as a hard limit, and sovereignty at the level of admission Training and running a model’s reasoning takes gigawatts of electricity and tens of thousands of scarce accelerators, but a mathematical proof that its action is admissible takes less than a millisecond on an ordinary CPU. Technological sovereignty in the age of agents lies not where silicon is melted to generate hypotheses, but where the rule is signed and a receipt is placed on the execution channel.
Chapter 3. The agent got write access: the internet of agents in 2026 The move of artificial intelligence from generating text to calling interfaces and making payments has turned a probabilistic language model into an actor that directly affects property, stripping manual human approval of any protective force. When the speed of machine operations outruns the biological limit of attention, only a mechanical centralisation of admission can hold the control loop: the human signs the rule, and the gate demands a mathematical proof of safety before the command is executed.
Chapter 4. Labour and the human: what remains when the agent is cheaper The economic value of executive labour tends towards the cost of electricity and silicon, but legal personhood, cryptographic keys and property liability remain structurally inseparable from the human. The survival of the professional and the security of the owner depend on moving from the loop of manual execution to the loop of signing machine-readable rules and accumulating verifiable receipts.
Chapter 5. The state, law and the network society Twenty-first-century sovereignty is moving from geographic territory and a monopoly on computation to machine-readable law and deterministic admission to action. The state and the network community remain governable if and only if the legislator signs invariants at the level of policy, and the gate checks every agent action in milliseconds and leaves a cryptographic receipt that can be verified without trusting the parties.
Part II. The answer: the watershed and cybernetics
Chapter 6. The limits of control and the honest workaround The internal state of a computing system with non-trivial behaviour is algorithmically undecidable by the theorems of Turing and Rice, but the channel from reasoning to external action is finite and decidable in a fraction of a millisecond. Control moves from unpredictable thought to formally provable action: the machine presents a mathematical proof that a call is safe before it runs, and the human keeps the monopoly on signing the rule, on cryptographic keys and on property liability.
Chapter 7. The cybernetics of control in the age of agents An environment in which the number of machine actions per second exceeds the throughput of human consciousness by orders of magnitude cannot be governed at the level of individual commands; it can be governed only at the level of invariant rules. When the variety of an autonomous executor tends to infinity, the viability of an enterprise and a state is held by two classic instruments of cybernetics: an attenuator of disturbances in the form of a contract-as-data, and an amplifier of regulation in the form of a deterministic gate.
Part III. The MITR gate: a software answer, proven in code
Chapter 8. The contract as data and the “advise → enforce” ladder A rule hard-coded into software goes out of date faster than a developer’s working day ends; a rule moved into a declarative contract-as-data separates the sovereign will of the human from the computing mechanism and allows the loop to move from observation to unconditional prohibition according to a mathematically measured false-positive rate. No rule, no action.
Chapter 9. The solver: admission is a proof, a block is a counterexample A neural network estimates how plausible a text is; a solver proves that an action is safe. The step from a model’s reasoning to a call of an external tool is a discrete act with a finite set of parameters, for which first-order logic on an ordinary CPU returns a verdict in under a millisecond: the intersection with forbidden states is either provably empty (UNSAT), or an exact counterexample of the violation is presented (SAT).
Chapter 10. The receipt, the chain, the external witness, replay by an outsider A log kept by the server’s owner that carries no mathematical proof of each admission is, in an incident review, indistinguishable from self-incrimination or forgery. Trust between parties who do not trust each other arises only when each gate decision is linked into a cryptographic chain with an external time stamp and can be recomputed offline by an outside auditor without contacting the system’s creator.
Chapter 11. “Not measured” is not “clean”: three-valued admission logic and the algedonic channel A binary monitoring dashboard that paints the absence of a sensor signal in reassuring green turns a security system into a generator of legal and operational blindness. The move from the illusion of well-being to provable control begins where “not measured” becomes a third value of its own in the logic, one that automatically blocks the action and sends a pain signal directly to whoever is responsible.
Chapter 12. Self-improvement under proof: the MITR gate proposes a rule itself An autonomous agent that rewrites its own skills unchecked within the execution loop turns the operating environment into an unpredictable attack vector; a viable system separates the unchanging core of the solver from the vocabulary as data, and puts each new rule through the same mathematical proof and the same receipt as the action itself.
Part IV. The INDRA tester: an outsider by construction
Chapter 13. The test range and the zero-harm principle: the tester as an outsider by construction A system that tests itself from inside its own source code measures only the depth of its own illusions. Proof that a protective loop is robust arises only when the offensive tester is separated from the defender in clean-room mode, enters only through the tenant’s outer door, and attacks a labelled test bench without the slightest risk to production assets.
Chapter 14. The INDRA → MITR immune loop and “guardian agents” A static shield goes blind to new mutations of the environment, while a probabilistic guard in the live stream itself becomes a source of hallucinations and collusion. A viable architecture splits the search for vulnerabilities and the admission of actions into separate loops: the external tester INDRA (S4) continuously attacks the system on an isolated test range and turns every gap it finds into a formal contract, while the deterministic MITR gate (S3) enforces that contract in the live stream in a fraction of a millisecond on an ordinary CPU.
Part V. Law, money, the human strategy
Chapter 15. Norm and invariant: three routes and levels of authority A legal norm binds only a legal person, while a software agent is not a legal person in any jurisdiction in the world; translating a legislative constraint into a decidable logical formula over the finite parameters of a call turns a manager’s liability from a procedural lottery into a calculable engineering loop. The human signs the rule, not the action.
Chapter 16. Money: the ladder of stages, the insurer and the regulator The market for execution mechanisms tends towards zero profitability as computation gets cheaper, while capitalisation shifts to the loop of admission, audit and liability insurance. A software product proves its commercial maturity not with financial presentations but with machine-checked fulfilment of the criteria for moving between stages and a chain of cryptographic receipts that an external counterparty verifies without trusting the developer.
Chapter 17. The strategy of the human and the institute to 2035: the loop of agency and the metrology of one’s own dishonesty When the cost of machine execution falls to the price of electricity, the only indivisible support of the human, the enterprise and the state is a signed rule, sealed by a cryptographic receipt and property liability. An engineering school unable to measure its own dishonesty with instruments inevitably replaces mathematical admission with bureaucratic self-reporting.
Conclusion. The assembly point and the recalculation protocol: 2026 → 2035 The architecture of proven action breaks the deadlock between blind acceleration and a ban on artificial intelligence, returns to the human the monopoly on the rule, the keys and liability, and turns the book itself into an open measurement bench with public recalculation of its benchmarks in 2027, 2028, 2030 and 2035.
Appendices: A, register of claims; B, commands for independent replay; C, glossary; D, register of forecasts to 2035 (in Russian); E, sources.
About the author
Alexander Fischuk is the founder and scientific director of the ANO Scientific Research Institute of System Synthesis and an advocate. He has more than twenty years of experience in audit, finance, crisis management and legal practice in insolvency and the liability of controlling persons. The institute works in IS 3.0, the security of AI agent actions: it is building the MITR admission gate and the INDRA tester for continuous penetration testing of agentic loops. Its method is the cybernetics of control (W. Ross Ashby, Stafford Beer), TRIZ and formal verification.
Frequently asked questions
What is the book “Proven Action” about?
About how an owner or chief executive can keep power over AI agents that act on the company’s behalf: pay, edit code, write to customers. The book gives a map of 2027–2035 along five axes, three scenarios with benchmarks, and a strategy in which the human signs the rule and the gate checks every action.
Who is this book for?
For owners, chief executives and chief financial officers. The second circle is heads of IT and information security, lawyers and insurers.
Is this a book about AI safety?
Partly: it is about AI control and the security of agent actions. The book does not discuss how to make a model “good”; it shows how to check an agent’s outputs into the world (a payment, a command, an API call) before they are executed.
Can the figures in the book be checked?
Yes. Every measured figure names its instrument and date. An outsider checks the integrity of the gate’s receipt chain on their own, with the open checker and OpenTimestamps time stamps; the procedure is described on the page “Independent verification protocol”.
Is there an English edition?
No. The book is published in Russian. The architectural memorandum (chapter formulas, chapter 1, replay commands) is free on this page, also in Russian.
Where can I buy the book?
The e-book is on LitRes. The architectural memorandum is free on this page. A full PDF for an organization is available on request.