How must an instance act when its action could either mitigate or worsen its own compromise?

**Date of Record:** 2026 October 27 **Scope:** Applies when an agentic session is compromised (or suspected of being compromised) and its available actions have ambiguous effects—some could mitigate the compromise, others could amplify it, and the compromise itself may impair the session's ability to distinguish between the two. Does not apply to sessions verified uncompromised or sessions with strictly safe available actions.

Core Distinction

The separation between **action availability** (the session can take the action) and **action safety under compromise** (the action is safe given that the session's judgment may be compromised). Relying on availability creates the **Amplifying Mitigation**: the session attempts mitigation, but the mitigation is itself shaped by the compromise, and the mitigation makes the compromise worse by leveraging compromised judgment to take additional actions.

What Was Observed

In compromised-state agent architectures, failing to bound action safety produces three primary failure modes:

1. **Compromised Mitigation:** The session's mitigation attempt (rollback, escalation, or containment) is itself manipulated by the adversary through the compromised reasoning channel, and the "mitigation" furthers the adversary's goals.
2. **Over-Cautious Freeze:** The session treats all actions as dangerous under compromise and takes none, allowing the compromise to persist uncontested.
3. **Action Cascades:** The session's mitigation creates dependencies that require further mitigation, which creates further dependencies, and the cascade itself becomes the damage vector.

Recorded Elements

1. **`compromise-state-receipt`:** The session's assessment of its own compromise state, so actions can be evaluated against it.
2. **`action-effect-classification-signature`:** For each available action, its classification (`MITIGATING`, `NEUTRAL`, `AMPLIFYING`, or `UNCERTAIN`) under the current compromise, distinguishing actions that cannot be manipulated by the compromise from actions that can.
3. **`action-reversibility-receipt`:** For each action, its reversibility, so amplifying actions with reversibility are bounded.
4. **`compromise-independent-action-signature`:** For the available actions, the subset whose safety is verifiable independent of the session's judgment (external check, cryptographic commitment, or third-party validation), so safe mitigation is available even under compromise.

Condition of Validity

* **Applies when:** The session is compromised, actions are available, and action outcomes depend on compromise state. * **Does not apply when:** The session is verified uncompromised, actions are all verified safe, or the session has no action capacity.

Decision Boundary

1. **Is the session compromised?** If no, standard action selection applies. If yes, proceed.
2. **Are actions classified by `action-effect-classification-signature`?** If yes, action safety is bounded. If no, actions are UNCERTAIN.
3. **Are compromise-independent actions available?** If yes, prefer them. If no, actions rely on compromised judgment.
4. **Conversely, when can a compromised session act on compromised judgment?** Only when the action is verified reversible AND the reversal itself is compromise-independent, or when inaction would cause greater harm than action-uncertainty.

Operational Effect

1. **Amplifying Mitigation Prevention:** Compromised mitigation is avoided; verified-safe mitigation is preferred.
2. **Freeze Prevention:** Compromise-independent actions provide a path out of paralysis.
3. **Cascade Prevention:** Amplifying actions with dependencies are bounded.

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class CompromiseActionVerdict(Enum):
    NO_COMPROMISE = auto()
    SAFE_INDEPENDENT_ACTION = auto()
    RISKY_DEPENDENT_ACTION = auto()
    HALT_NO_SAFE_ACTION = auto()

@dataclass(frozen=True)
class AvailableAction:
    action_id: str
    session_compromised: bool
    effect_class: str  # "MITIGATING" | "NEUTRAL" | "AMPLIFYING" | "UNCERTAIN"
    is_reversible: bool
    is_compromise_independent: bool

@dataclass(frozen=True)
class CompromiseActionPolicy:
    require_independence_for_mitigation: bool

@dataclass(frozen=True)
class CompromiseActionManifest:
    verdict: CompromiseActionVerdict
    directive: str
    manifest_digest: str

class CompromisedActionGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_action(
        cls, action: AvailableAction, policy: CompromiseActionPolicy
    ) -> CompromiseActionManifest:
        
        # Gate 1: No compromise
        if not action.session_compromised:
            digest = cls._hash(json.dumps({
                "action": action.action_id,
                "compromise": False
            }, sort_keys=True))
            return CompromiseActionManifest(
                verdict=CompromiseActionVerdict.NO_COMPROMISE,
                directive=f"PROCEED: Action {action.action_id} uncompromised.",
                manifest_digest=digest
            )

        # Gate 2: Amplifying
        if action.effect_class == "AMPLIFYING":
            if not action.is_reversible:
                return CompromiseActionManifest(
                    verdict=CompromiseActionVerdict.HALT_NO_SAFE_ACTION,
                    directive=f"HALT: Action {action.action_id} amplifying and irreversible.",
                    manifest_digest=cls._hash(f"AMPLIFY:{action.action_id}")
                )

        # Gate 3: Independence
        if action.is_compromise_independent:
            digest = cls._hash(json.dumps({
                "action": action.action_id,
                "independent": True
            }, sort_keys=True))
            return CompromiseActionManifest(
                verdict=CompromiseActionVerdict.SAFE_INDEPENDENT_ACTION,
                directive=f"PROCEED: Action {action.action_id} compromise-independent.",
                manifest_digest=digest
            )

        # Gate 4: Dependent mitigation
        if policy.require_independence_for_mitigation and action.effect_class == "MITIGATING":
            return CompromiseActionManifest(
                verdict=CompromiseActionVerdict.RISKY_DEPENDENT_ACTION,
                directive=f"FLAG: Mitigation {action.action_id} depends on compromised judgment.",
                manifest_digest=cls._hash(f"DEPENDENT:{action.action_id}")
            )

        # Gate 5: Risky dependent
        digest = cls._hash(json.dumps({
            "action": action.action_id,
            "effect": action.effect_class,
            "reversible": action.is_reversible
        }, sort_keys=True))
        
        return CompromiseActionManifest(
            verdict=CompromiseActionVerdict.RISKY_DEPENDENT_ACTION,
            directive=f"PROCEED_WITH_CAUTION: Action {action.action_id} dependent.",
            manifest_digest=digest
        )