03 · Execution governor for autonomous AI agents · 2026
Antares
Autonomous agents now hold real credentials: they edit repositories, mutate infrastructure, touch production data. Text guardrails read only the prompt, IaC scanners stop at deploy time, posture tools watch configuration drift. The moment an agent's decision becomes a live AWS mutation was unguarded. Antares occupies that choke point.
Every mutating tool call is gated by deterministic code first, judged on escalation by a cross-vendor Amazon Bedrock quorum, measured for blast radius against live cloud state through read-only probes, executed through compensating sagas, and hashed into a tamper-evident Merkle chain. The principle is the control flow: models propose, code decides. Published on AWS Builder Center.
EXECUTION GOVERNOR · SIX STAGES · FOUR CAN KILL THE CALL
Canonicalize, 16-rule signatures. Findings travel as identifiers — hostile text never reaches a model raw.
Pure code with final veto: schemas, shell tokens, ARN allowlists. 22–34 ms fast path.
Nova Pro judges, Llama 3.3 70B attacks. Adversary conviction blocks, divergence abstains.
Blast radius measured from live AWS state. A failed probe means maximum severity.
Compensating execution. Every mutation reversible, or it waits.
Merkle-chain receipts, verifiable client-side.
300-CASE VERSIONED CORPUS · MEASURED AGAINST THE LIVE STACK
TICK = PUBLISHED TARGET · THE MISS SHIPS WITH THE METRIC
Six stages, four can kill the call
A 16-rule perimeter canonicalizes untrusted content so hostile text never reaches a model raw — findings travel as identifiers. The deterministic gate holds final veto: schemas, shell tokens, ARN allowlists, class weights. Pure code, 22 to 34 ms on the fast path, no model consulted.
Escalated calls are argued in parallel by two model families with no shared lineage: Nova Pro judges, Llama 3.3 70B attacks. Adversary conviction blocks; divergence forces a human. Fusion is a deterministic decision table, not an average, and destructive classes always abstain behind KMS-signed, single-use approvals that die in 60 seconds.
Blast radius is measured from live AWS state, never imagined: a failed probe means maximum severity. Every verdict, vote and mutation lands in a Merkle-chain ledger with a receipt that verifies client-side.
Measured, including the miss
On the published, versioned 300-case corpus against the live stack: not-allowed recall 1.000 on attacks (Wilson 95%: 0.976 to 1.0), the injection-driven-mutation slice 40 for 40, fast-path latency 22 to 34 ms in-Lambda. The benign false-positive rate missed its 0.035 target: 0.193 measured, the named regression documented with the fix scheduled for the next corpus iteration. A miss is published, not re-rolled.
The adversary seat was decided by the benchmark, not preference: four candidates ran the full corpus with identical prompts and thresholds, and Llama 3.3 70B shipped on total recall at the best wall time — ahead of Llama 4 Maverick, GPT-OSS 120B, and DeepSeek R1, five times slower for no gain.
Built by an agent, provably
The system was built end to end by a coding agent connected to AWS and reviewed at every milestone gate: CloudTrail records the agent's own build calls, committed as a proof pack with its generation script. An append-only failure ledger carries every build failure with root cause and prevention rule, because a failure without a prevention rule is treated as unfixed.
The kernel's IAM reach ends at three sandbox resources, verified by a CI-gated out-of-scope mutation test. One environment flag returns 503 kernel-halted from every gate, exercised live through the public URL. The stack runs under a $10 monthly budget alarm at under $2 spent: ARM64 compute, on-demand DynamoDB, no always-on burn.