Guardrails: Action Authorization Through L4

Every side-effecting proposal from L5 passes through L4 orchestration, which checks envelope, authority, and rate limits before anything reaches L1.

L4 is the gate, not the copilot

A copilot can compose a proposal, but it cannot authorize it. Authorization is the job of L4 orchestration, a deterministic layer between the reasoning copilots (L5) and the control plane (L1). Every propose-class action is submitted to L4, which independently checks it against the certified safe operating envelope, the operator's authority, rate and concurrency limits, and machine mode before it may be forwarded to L1 for execution.

The authorization pipeline

authorize(proposal, operator, state):
  if not schema_valid(proposal):        return DENY('malformed')
  if not envelope_contains(state+proposal): return DENY('envelope')
  if not operator.authority >= proposal.level: return DENY('authority')
  if rate_limit_exceeded(proposal):     return DENY('rate')
  if machine_mode incompatible:         return DENY('mode')
  if proposal.side_effect and not human_confirmed: return HOLD
  return FORWARD_TO_L1(proposal)        # L1 still owns execution

Independent of the model

The authorization checks are deterministic code, independent of the language model that produced the proposal. A copilot cannot talk L4 into approving an unsafe action; L4 re-derives envelope membership from the full current state rather than trusting the copilot's assertion that a proposal is safe. This is the core of defense in depth — the reasoning layer can be creative because the authorization layer is rigid.

• Envelope check over full state, recomputed by L4 (not trusted from L5)
• Operator authority check against the action's required level
• Rate and concurrency limits to prevent action storms
• Machine-mode compatibility (commissioning / shot / recovery)
• Human confirmation required for side-effecting actions

Only after L4 authorizes does an action reach L1, which owns execution and retains its own interlocks and the autonomous hardware failsafe. There are thus three independent barriers between a copilot's idea and the plant: schema validation, L4 authorization, and L1/hardware interlocks. Every decision — approve, hold, deny — is logged for audit. See envelope checks and refusal and escalation.