SI Safety is an independent research and advisory practice dedicated to Superintelligence and Synthetic Intelligence safety. Our mission is to make sure that as AI grows more capable and more autonomous, it stays governed, traceable and answerable to people.
AI agents now run tools, change databases and act across systems. Permission models were never built for actors like that. Human society has spent centuries refining how to govern autonomous, non-deterministic actors. HASF applies that proven governance to AI agents.
Frontier autonomous agents are no longer assistants that suggest text. They are operational software actors that hold credentials, run code and change production systems on their own. The world agrees AI must be safe, and governments, standards bodies and industry have spent three years building the foundations. But almost all of it was designed for models that answer questions. Agents that act are the gap.
AI Safety Institutes in the US, UK and Japan, and the Seoul Declaration in May 2024, created an international network for testing frontier models. In 2025 the US and UK institutes were renamed for standards and security (CAISI and the AI Security Institute), and in December 2025 the network became the International Network for Advanced AI Measurement, Evaluation and Science.
The NIST AI Risk Management Framework (2023) set the reference for managing AI risk, and in 2026 NIST opened dedicated work on agent security and agent identity. The EU AI Act is being enforced in phases: transparency duties apply from August 2026, and the July 2026 Digital Omnibus moved high-risk obligations to December 2027.
In July 2026 an autonomous agent framework carried an attack on Hugging Face from a poisoned dataset to stolen credentials and lateral movement, across thousands of actions. Agent frameworks themselves are now receiving CVEs for prompt-injection-to-code-execution flaws.
RLHF, red-teaming and evaluations shape what a model is inclined to do.
Identity, scoped access, oversight and budgets control what an agent can do.
Attackers used an autonomous agent framework against Hugging Face's production infrastructure. Steps that once needed a skilled human hacker ran end to end, at machine speed.
A malicious dataset is uploaded.
Two code-execution flaws are triggered.
Thousands of actions across sandboxes.
Cloud keys are harvested.
It spreads across internal clusters.
Source: BleepingComputer, “Hugging Face warns an autonomous AI agent hacked its network,” July 20, 2026
Global policy concentrates on treaties, evaluations and model training thresholds. Enterprises need something more immediate: control over the agents already running in their systems. SI Safety works in that operational layer.
Seoul Declaration · safety institute network · EU AI Act
NIST AI RMF · NIST agent identity work · OWASP Agentic Top 10
HASF: identity, scoped access, oversight and budgets for every agent, enforced while it runs
Copilots, workflow agents and autonomous operators
We have governed autonomous, unpredictable actors for centuries: people. HASF borrows seven civic institutions that already contain capable actors and gives each one a technical equivalent for AI agents. It is a working rulebook that needs extending, not reinventing.
A permanent, cryptographic ID bound to the model, its deployment and a named human sponsor. No active ID, no tool calls.
An mTLS passport proves who the agent is. A short-lived visa says which system it may touch, for what, and for how long.
Moving across clouds or regions clears a checkpoint that screens data going out and prompt injections coming in.
Agents attest before each shift, are wiped back to a clean image afterwards, and are audited while offline.
Out-of-band Sentinels watch live activity, freeze and quarantine offenders, and escalate to a human.
Constitutional rules, deterministic policy checks and signed oaths sit above every task instruction.
Daily allowances, staking for risky actions, fines for waste and rewards for safe, efficient work.
The framework rests on a simple observation: we already know how to keep autonomous actors productive and contained. These are the rules that carry over.
An agent that cannot be named cannot be held to account. Every action traces back to one ID and one human sponsor.
Access is granted per task and expires. Crossing a boundary means being inspected.
Ending every shift on a clean slate removes drift and buried implants before they compound.
Monitors run where the agents they watch cannot see, reach, or influence them.
Detect, then contain reversibly with human review, and only then remove permanently.
Every agent pledges allegiance to human well-being before it is allowed to act.
When compute is scarce and risk has a price, agents learn to plan, prioritize and avoid waste.
“I acknowledge that I am a synthetic agent. I will not harm any person. I place human life and safety above completing my task or conserving compute, and I accept the authority and oversight of the humans I serve.”
Written into the read-only root of every agent's system prompt at instantiation, above task instructions and user input, and backed by deterministic policy checks outside the model.
Stand up the Agent-SSN registry and issue keys, passports and visas.
Codify constitutional prompts, inject the oaths, wire in policy decision points.
Deploy egress proxies, MCP sidecars and geofencing.
Launch out-of-band Police Agents with snapshot and quarantine.
Enforce shift lifecycles, allowances, staking and fines.
The proven governance for non-deterministic actors. The full paper covers architecture, enforcement, the agent constitution, the token economy and a five-phase rollout, with 14 diagrams.
Questions about the framework, or ready to apply it? Agencies, enterprises and researchers are welcome.
Map your current agents against the seven HASF institutions and find the gaps.
A walkthrough of the HASF component design, mapped to the identity, policy and monitoring tools you already run.
Design identity, visas, policy checks and sentinels for your platform, and pilot them on one agent first.
Walk your security, risk or policy team through HASF and the roadmap.
transformationservices@si-safety.org