--- before.md
+++ after.md
@@ -1,5 +1,6 @@
---
date: '2026-03-17T09:00:00-07:00'
+lastmod: '2026-09-16T22:20:00-07:00'
draft: false
title: "The Mission Shaping Problem"
aliases:
@@ -18,6 +19,8 @@
- Security
---
+> **Revision — September 16, 2026.** The context-integrity discussion previously overstated containment's exclusive role in interrupting misuse within approved authority. This revision recognizes runtime semantic checks as an additional intervention mechanism while retaining containment as necessary protection when those checks miss the problem. [Revision history](#revision-history).
+
When a CFO asks an agent to assemble the board packet, reconcile the final numbers, and call back for approval before releasing the presentation, they are not specifying an access control list. They are expressing intent.
Something has to turn that intent into something a control plane and its enforcement points can evaluate. That conversion is the Mission shaping problem.
@@ -181,13 +184,13 @@
Prompt injection is the concrete case. The agent is processing a document, an email, or an API response. That content contains adversarial instructions designed to redirect behavior. The enforcement point sees calls that fall within the shaped authority envelope. Nothing is flagged. The user's approved intent has been subverted without a single authorization failure.
-This is not a problem that shaped authority models solve. It is a problem they cannot observe.
-
-Several partial defenses are possible. Isolating the shaping step before the agent reads external content prevents adversarial inputs from influencing the authority model, but only for tasks whose execution path is knowable upfront. Intent anchoring cryptographically binds the approved purpose to the authority artifact and creates a reference point for post-hoc analysis. It does not prevent context taint inside that envelope. Call provenance logging helps reconstruct what happened after the fact. Human confirmation gates on irreversible actions limit the damage an injected instruction can accomplish even when it successfully redirects the agent.
-
-But these are not enough on their own. Prompt injection is where containment has to carry more weight than Mission shaping. There is no semantic layer that can observe what happens inside the agent's context window.
-
-Context integrity failures compound the runtime alignment problem. A semantically intact Mission Authority Model offers no signal that the agent has been redirected. Every call looks authorized, every action is within bounds, and the alignment signal remains flat. The only layer that can interrupt is containment: mediated tool calls that block categories of action regardless of the instruction that triggered them, and human confirmation gates that fire on irreversible operations before they complete. An agent that cannot exfiltrate data without going through a logged, rate-limited outbound adapter is less useful to an injected instruction even if the instruction successfully redirected the agent's behavior.
+A shaped authority model alone cannot establish whether an authorized action still serves the approved purpose. That requires evidence about the proposed work and how it relates to the intent.
+
+Several partial defenses are possible. Isolating the shaping step before the agent reads external content prevents adversarial inputs from influencing the authority model, but only for tasks whose execution path is knowable upfront. Intent anchoring cryptographically binds the approved purpose to the authority artifact and creates a reference point for runtime checks and post-hoc analysis. It does not prevent context taint inside that envelope. Call provenance logging helps reconstruct what happened after the fact. Human confirmation gates on irreversible actions limit the damage an injected instruction can accomplish even when it successfully redirects the agent.
+
+An authorization check can keep passing while the agent pursues the wrong purpose. The shaped authority model alone does not reveal that redirection. Runtime semantic checks may detect a mismatch between the proposed work and the approved intent, and trigger a pause before the next consequential action.
+
+Those checks cannot reliably establish that the agent's context is uncompromised. They may miss the redirection or be influenced by the same untrusted material. Containment therefore remains necessary: mediated tools, narrow credentials, restricted egress, and action-bound approval limit what happens when both the agent and its evaluator are wrong.
Consider a less structured case than the CFO workflow: an agent asked to research vendors, summarize options, and begin outreach where appropriate. That task crosses external content, third-party tools, evolving selection criteria, and ambiguous action boundaries. A Mission shaped for that task can still provide a governance record and some outer bounds. But the real safety properties are more likely to come from mediated outreach, short-lived credentials, sandboxed browsing, and explicit release gates before any external communication is sent. This is the kind of open-world case where containment is not a complement to Mission shaping so much as the more reliable layer.
@@ -352,3 +355,15 @@
The harder question starts after that. A well-shaped Mission can still fail under quiet scope expansion, delegation, headless execution, stale state, and open-world runtime redirection. That is where containment, runtime alignment, and survivable incorrectness become the more important story.
[Part 2: Mission Shaping Is Not Enough](/notes/mission-shaping-is-not-enough/) picks up from there.
+
+# Revision History
+
+**September 16, 2026 — Correction.**
+
+- Qualified the context-integrity claims that only containment can interrupt misuse within approved authority and that no semantic layer can observe it.
+- Recognized runtime checks against approved intent as a possible intervention, while retaining containment for failures of both the agent and its evaluator.
+- Clarified that intent anchoring can support runtime checks as well as retrospective analysis.
+
+[Version preserved before this revision](/revisions/the-mission-shaping-problem/2026-09-16/) · [Exact diff](/revisions/the-mission-shaping-problem/2026-09-16/changes.html) · [Revision source](/revisions/the-mission-shaping-problem/2026-09-16/after.md) · [Source hashes and provenance](/revisions/the-mission-shaping-problem/2026-09-16/manifest.json).
+
+The preserved version is the repository text immediately before this revision, not a claim about the original publication or its deployment date. Earlier editorial history is not reconstructed here.