Terms of the security of AI agent actions, as they are used in the book Proven Action (in Russian) and on this site, followed by the terms of the institute’s method. Chapter and appendix references are to the book.
Terms of IS 3.0 and the book
- MITR: a deterministic gate for the admissibility of an agent’s actions. It checks every tool call against contracts written as data, using a solver, and writes a receipt to a hash chain (chapters 8–12). See MITR.
- INDRA: a tester that is an outsider by construction. It attacks the loop only through the tenant’s outer door and turns a vulnerability it finds into a draft of a new contract: a continuous penetration test of the agent loop (chapters 13–14; being built, gates A–E).
- The “thought → action” watershed: the boundary at which what is checked is not the model’s reasoning but the finite set of parameters of a call to an external tool.
- Contract as data: a rule written declaratively in a contract file rather than in program code; as of October 2026 the MITR/policies/contracts/ catalogue holds 19 contracts.
- Solver (SMT): a program that checks the satisfiability of logical formulas (in MITR, Z3, the z3_gate.py module); it runs on a CPU. See formal verification.
- UNSAT: the verdict “unsatisfiable”: the intersection of the observed facts of the action with the set of forbidden states is empty, so the action is admitted.
- SAT: the verdict “satisfiable”: a counterexample of a contract violation has been found, so the action is blocked, and the violated rule and the conditions for a fix are returned.
- Advisory mode: the solver checks every call and writes a receipt, but the agent is not blocked; statistics of false blocks build up. The mode is set by a per-class flag in the settings of the gate service; the default is advisory.
- Enforce mode: a call with a SAT verdict is not executed. A class of actions is moved here when the share of false blocks over a 14-day window is below the threshold with a non-zero flow.
- Receipt: a record of a decision (both “yes” and “no”) in the chain with an external timestamp, verifiable without trusting the owner of the server; related objects of 2026 are IETF attestation receipts and execution outcome attestation.
- Hash chain: a sequence of records in which each one contains the SHA-256 hash of the previous one; editing any record breaks all the following ones.
- OpenTimestamps anchor: an external timestamp for the state of the chain: after it, the owner of the server cannot quietly rewrite the history.
- Tenant: a client of the gate with its own token and an isolated loop; the number of live tenants is a line of
gate_mode_report.py --tenants. - “Not measured”: the third value of admission (⊥) next to “yes” and “no”: the absence of a signal is not counted as “clean” and is not executed (chapter 11).
- Truth discipline labels: MEASURED, BEING BUILT, PLAN, FORECAST (truth_marking); for monetary claims, FACT and HYPOTHESIS (appendix A).
- Branch A/B/C: a forecast scenario: A, “normal technology”; B, “continuation of the trend” (the book’s base branch); C, “acceleration”.
- Benchmark: the date and source by which a forecast is resolved (appendix D).
- Gate (of a stage): an acceptance criterion for a stage, counted by an instrument, with a deadline; for example, the INDRA gates A–E.
- The R2a series: the gate of live operation: 14 days in a row with at least 50 checks a day from at least two tenants and zero bypasses of the interceptor.
- Gate X5: at least one external tenant with its own token over 14 days.
- “Six out of six”: the milestone at which the instrument
gate_mode_report.py --sixconfirms all six basic propositions of MITR; as of 9 October 2026, 1 of 6. - P1–P5: the matrix of machine proofs for an investor. P3 is the chain, the anchors and the replay of decisions; P4 is the price of a decision (0.74 ms for a decision and 3.3 ms for a call with an explanation on 26 September 2026; 0.95 and 4.3 ms on node 147 on 14 October 2026); P1 is an attack set with an external signature; P5 is an industrial pilot of at least 30 days.
- Verifier for an outsider: verify_chain_standalone.py. It recomputes the chain and replays the gate’s decisions with any SMT-LIB solver, without a line of MITR code (ADR-0281); on 14 October 2026, 4,958 of 4,958.
- IFR (ideal final result): the ideal final result in TRIZ, G. S. Altshuller’s theory of inventive problem solving.
- VSM: Stafford Beer’s viable system model: S1, operations; S2, coordination; S3, management; S3\*, independent audit and admission; S4, intelligence; S5, policy.
- S3\*: in the VSM, audit and admission independent of operational management; the place of the MITR gate.
- Algedonic channel: an emergency pain signal that bypasses the hierarchy; in MITR, the principle “not measured, not executed” with escalation to a human (S5).
- Levels of authority: the Chinese three-level scheme (decisions only by the user, on the user’s instruction, by the agent on its own; see China’s rules for AI agents); in MITR, the advisory and enforce modes with a move between them by the share of false blocks.
- Guardian agent: Gartner’s term for systems that watch, check and limit other agents; MITR is a deterministic guardian over contracts as data.
- KYA (Know Your Agent): the identity of an agent and the delegation of authority to it (DIF KYA-OS, NIST 2026); in MITR, the tenant and the token.
- Network jurisdiction: a community with its own machine-readable law and gate, recognized by an agreement with the state (FORECAST).
- MCP, A2A, AP2, x402: protocols of the 2026 internet of agents: connecting tools (MCP), interaction between agents (A2A), agent payments (AP2, x402).
Terms of the institute’s method
The terms the institute uses in its Doctrine, in the description of its method (both in Russian) and in its work. For each term, the sense in which it is used and the tradition it comes from are given. Terms that have a precise meaning in mathematics are used either in that meaning or with an explicit reservation.
System synthesis
A method of assembling systems from conflicting requirements in which the conflict is removed by separating the requirements along different coordinates of the system, not by averaging. It applies only when there is a structural contradiction. It is not a synonym for “integration”, “hybrid” or “comprehensive approach”: integration joins what is compatible; synthesis joins what is incompatible, at the price of introducing an additional coordinate.
Invariant
A property that a system must hold in its external environment regardless of changes in its composition and state. It is used here in a sense close to a loop invariant in the theory of programs: a statement that is true before and after each step. An invariant describes an obligation of the system, not its design and not its intention.
Structural contradiction
A pair of requirements in which one requires a property to be present and the other requires it to be absent. It goes back to the technical and physical contradiction of the theory of inventive problem solving (TRIZ). It differs from a conflict of interest: a conflict of interest belongs to the parties, while a structural contradiction belongs to the system itself and persists with any set of participants.
The term “topological rupture”, which appears in working materials as an image, is not used on these pages: topology has a precise mathematical meaning that does not apply to the phenomenon described.
Separation coordinate
The dimension along which conflicting requirements are met separately: the level of the system, the phase of time or the control loop. A direct application of the independence axiom of axiomatic design, in which functional requirements are distributed over independent design parameters.
Feedback loop and its closure
A loop is considered closed if an error at the output of a block becomes a corrective signal at the input of the preceding block without an external operator. A loop that needs a human to pass the signal on or to make the correction is considered open, and it is counted as such when the system is assessed. There are no intermediate states in this assessment.
Algedonic channel
The channel of an emergency signal in Stafford Beer’s viable system model: the path by which a signal of pain or threat passes through the levels of management, bypassing the usual approval procedure. It is used here in its original meaning. The presence of such a channel does not make a loop closed if the recipient of the signal is still a human.
Requisite variety
W. Ross Ashby’s law: the variety of the controlling loop cannot be less than the variety of the controlled object, otherwise control is impossible. It is used in its original meaning and serves as a constraint when choosing a separation coordinate: moving a requirement to a level whose variety is insufficient leads to a loss of controllability.
Ideal final result
The form of stating a goal in the theory of inventive problem solving: the function is performed, but there is no system performing it. It is used as a guide for formulating an invariant, not as an attainable state.
Deterministic verification
A check of the admissibility of an action that gives the same result on the same input data and rests on a proof, not on an estimate of probability. It is opposed to probabilistic filtering, where the same input can lead to different decisions. A refusal by such a check blocks the action before it is executed, rather than signalling afterwards.
Nearly decomposable system
Herbert Simon’s notion: a system in which the links within a level are substantially stronger than the links between levels. It serves as the basis for separation by level: if the links between the supposed levels are comparable to the links within them, the levels have been identified wrongly, and the separation will be illusory.
Emergence
The appearance in the assembled whole of properties that none of its parts has. It is used in a descriptive sense, without strong philosophical assumptions. In organizations, unlike in materials, emergence is not checked by testing a sample: only the consequences can be checked, and only with a delay.
The full account of the procedure, the conditions of refusal and the limits is on the page “The method of system synthesis” (in Russian).