Executive Summary: Prompt guardrails are probabilistic—which means a clever indirect prompt injection in an invoice, email, or webpage can still trick an autonomous AI agent into wiring money, escalating IAM privileges, or mutating vendor payment records. ACP (Alfa Command Protocol) replaces stochastic LLM guessing at the execution boundary with a Pre-Deterministic Outcome Engine for AI Systems.
1. Why Probabilistic AI Guardrail Prompts Fail at the Execution Gate
When an enterprise gives an AI agent tool access to initiate treasury transfers, approve vendor bank changes, or deploy production infrastructure, "system prompt instructions" and secondary LLM judge calls operate inside the same probabilistic token space as untrusted external content. Because stochastic token sampling has no cryptographic concept of human origin or byte integrity, an attacker can craft an indirect prompt injection that persuades the model a high-risk action was already approved.
2. How ACP Maps the 5 Identity Physics Inputs to a Fixed State Table
In the {^} Protocol One Trust Stack, the AI model never decides whether a privileged action is permitted. Instead, ACP (Alfa Command Protocol) intercepts the tool call before execution and evaluates 5 cryptographic proof axes in 0ms:
-
Who? (
Tri-Signature): Three sequential handwritten human signatures (Intent, Identity, Confirmation) completed within the strict≤10.0sIdentity Physics burst window. -
What? (
DocLock 1.5): OfflineSHA-256byte, text, pixel, and QR trust capsule verification (183/183deterministic checks — "DocLock proves a document is unchanged, not that what it says is true"). -
Label? (
Alfa Code): A checksummed label (ALFA-P1-ORG-MESA-85206-000001-E3) for the record; not proof of location, ownership or identity. -
When? (
CryptoLock + CLK-ATTEST-1): Dual-authority RFC 3161 trusted timestamps (FreeTSA + DigiCert) plus OpenTimestamps anchoring (ATTESTEDvs.LOCAL-ONLYvs.ATTESTATION-MISMATCH). -
How? (
Identity Physics): CryptographicSHA-256binding between the exact tool-call parameters and the sealed authorization capsule.
3. The 7 Pre-Deterministic ACP Rules & Finite Outcomes
| Rule ID | Cryptographic Input State | Pre-Deterministic Outcome |
|---|---|---|
| ACP-RULE-01 | DocLock 1.5 = INTEGRITY_ALERT / BROKEN_SEAL or Payload SHA-256 Mismatch | QUARANTINE_BROKEN_SEAL |
| ACP-RULE-02 | CLK-ATTEST-1 = ATTESTATION-MISMATCH (Clock Skew / TSA Conflict) | REJECT_ATTESTATION_MISMATCH |
| ACP-RULE-03 | TIER_3_READ_ONLY + DocLock 1.5 VERIFIED + Payload SHA-256 Match | ALLOW_EXECUTE |
| ACP-RULE-04 | Tier-1/Tier-2 Mutation Missing Tri-Signature or Valid Alfa Code | REJECT_UNSEALED_ARTIFACT |
| ACP-RULE-05 | Tri-Signature Burst > 10.0s Ceiling (Expired or Replay Attempt) | REJECT_BURST_WINDOW_EXCEEDED |
| ACP-RULE-06 | DocLock = WARNING or Tier-1 Treasury Call with LOCAL-ONLY Clock | HOLD_STEP_UP_HITL |
| ACP-RULE-07 | All 5 Identity Physics Proofs Valid (Tri-Signature ≤10.0s + DocLock VERIFIED + Alfa Code + CLK-ATTEST-1) | ALLOW_EXECUTE |
4. G.A.I.L. Oversight: "The AI Reads the Proof; It Is Never the Proof"
Every ACP evaluation emits a canonical JSON decision receipt sealed with SHA-256 and the 3-byte ASCII {^} Digital Corporate Mark (0x7B 0x5E 0x7D). G.A.I.L. (Guardian Adaptive Intelligence Layer) audits that the runtime honored the ACP receipt—ensuring zero silent execution and complete EU AI Act Article 14 human-in-the-loop accountability.