Intent can drift into effect.
Agent reasoning, tool permissions and execution paths can become coupled in ways that make duplicate, stale or insufficiently authorized actions harder to contain and audit.
MODEL→TOOL→EFFECT
VSL-ECP · External Effect Control Plane
The SI era is here.
Authorization still matters.
ECP governs authority to attempt a specific external effect and preserves evidence of what actually happened after execution was attempted. VSL-ECP keeps model reasoning, authority, execution attempt and observed external outcome distinct.
NO VALID EFFECT AUTHORITY → NO ECP-AUTHORIZED DISPATCH
CANONICAL CLAIM LOCKAUTHORIZED ATTEMPT ≠ CONFIRMED EFFECT · UNKNOWN ≠ SAFE TO REDISPATCH.
PHYSICAL CONCEPT / VSL-ECP
15 SEC · AUTOPLAY LOOP
A physical visualization of the control boundary. The video loops automatically; sound is optional. The validated prototype is software infrastructure.
20independent Cloud Run tasks
1successful consumption
19already consumed
0exceptions
The control gap
Reasoning is not authorization.
Autonomous systems are moving from generating answers to using tools, changing infrastructure, executing workflows and affecting real systems. A model can propose an action without the enterprise having authorized that exact consequence.
VSL-ECP is designed for the boundary between reasoning → authorization → execution attempt → observed effect → evidence.
An effect crosses a separate authorization boundary.
The agent may request. ECP verifies whether that specific effect has valid authority, records the execution attempt separately, and preserves the observed outcome as CONFIRMED, FAILED or UNKNOWN.
REQUEST→PERMIT→ATTEMPT→OBSERVED EFFECT
Public architecture
Agent-native outside.
Deterministic at the trust boundary.
The agentic layer may interpret, normalize, observe and explain. Authoritative decisions and state transitions remain deterministic. The public model explains that boundary without exposing cryptographic internals, credentials or private deployment details.
01External Agent
/ SI Systemproposes a bounded effect
/ SI Systemproposes a bounded effect
effect.propose
02Effect Broker
Agentnormalize · context
Agentnormalize · context
authority.request
03Deterministic
ECP Coreauthority · state · evidence
ECP Coreauthority · state · evidence
authority.decision
04Dispatch
Adapterbounded invocation only
Adapterbounded invocation only
authorized attempt
05External Tool
/ Systembounded reversible target
/ Systembounded reversible target
evidence.observe
06Evidence Agent
/ ObserverCONFIRMED · FAILED · UNKNOWN
/ ObserverCONFIRMED · FAILED · UNKNOWN
Agents may propose
An external agent may provide intent and context. It cannot grant itself effect authority.
Broker may normalize
The Effect Broker Agent may map intent to the canonical effect schema and request authority. The A1 contract does not grant broker messages authority to create or modify authoritative effect authority.
Core stays deterministic
The ECP Core owns authoritative decisions, permit state and evidence-bearing state transitions.
Evidence preserves uncertainty
The observer may correlate evidence, but UNKNOWN cannot become CONFIRMED without evidence and does not authorize blind redispatch.
Validated behavior
A bounded Google Cloud prototype survived distributed contention.
In the recorded test, 20 independent Cloud Run tasks contended for the same permit. One task consumed it successfully. The other 19 observed that the permit had already been consumed. Cloud Spanner persisted the final consumed state and the winning task.
VALIDATED TECHNICAL PROTOTYPE · BOUNDED TECHNICAL EVIDENCE
G1.3C-001PASS
CONTENDERS20
SUCCESS1
ALREADY_CONSUMED19
EXCEPTIONS0
PERSISTED STATECONSUMED
VERSION2
Observed single-consumption behavior under the tested contention conditions.
Validated bounded Google Cloud experiment
- 20 independent Cloud Run tasks
- 1 SUCCESS
- 19 ALREADY_CONSUMED
- 0 exceptions
- Cloud Spanner persisted final consumed state and winner
Validated technical prototype
Authorization-to-effect provenance
- authorization, execution attempt and observed effect kept distinct
- CONFIRMED / FAILED / UNKNOWN effect semantics
- duplicate/replay produced no second logical action in the tested bounded scenario
- target/effect binding rejection and recovery after UNKNOWN without redispatch
- offline causal replay and clean reproduction from a frozen package
ECP-INTEROP-DIFF-001 · PASS_BOUNDED
Historical ECP-INTEROP-DIFF-001 used a bounded private Cloud Run provider, a dedicated Google Cloud Storage effect surface and Spanner provenance. ECP separately preserved authorization, execution-attempt and observed-effect state across CONFIRMED, FAILED and UNKNOWN outcomes. Duplicate blocking, offline replay and one clean logical reproduction from a frozen package were recorded under the stated bounded conditions.
Authorization → observed outcome
From authorization to effect provenance.
A valid permit proves authority to attempt an effect. It does not prove that the external effect actually occurred.
VSL-ECP preserves a reconstructable chain of what was proposed, what authority was granted, what was attempted, what was actually observed and under which bounded software/policy context the action occurred.
INTENT→PROPOSED ACTION→AUTHORIZATION→PERMIT→EXECUTION ATTEMPT→OBSERVED EFFECT→RECEIPT→POST-EFFECT STATE
Evidence indicates that the intended external effect occurred.
The attempt did not produce the intended effect.
Available evidence is insufficient to assert either success or failure.
VALID PERMIT + FAILED EFFECT ≠ SUCCESS
VALID PERMIT + UNKNOWN EFFECT ≠ SUCCESS
NO RECEIPT ≠ PROOF OF NO EFFECT
ECP-INTEROP-DIFF-001 · PASS_BOUNDED.
Authorization, execution attempt and observed effect remained separately reconstructable under the stated bounded test conditions.
Forensic surface
Reconstruct the chain, not just the log.
For each bounded effect trace, the provenance architecture is designed to preserve verifiable references without publishing confidential schemas or operational identifiers.
Who proposed it. Who authorized it. What executed it. What actually happened. Under which version.
agent intentproposed actionauthorization requestpermit decisionpermit validationexecution attemptobserved external effectauthorization receipteffect receiptpost-effect stateactor and workload identitiessoftware / policy / schema versionincident and correction lifecycle when applicable
Interactive protocol demonstration
See the authorization boundary behave.
This browser-only demonstration contains no production credential, confidential implementation or consequential external effect. It illustrates the public state model and the separation between permit consumption and observed effect outcome.
Interactive protocol demonstration · browser-only.
AGENTAction requestWaiting
PERMITNoneNo authority loaded
ECPStandbyauthorization boundary
EFFECTBlockedexternal side
RECEIPT—auditable evidence
DEMO AUTHORIZATION RECEIPT
SIMULATED PROVIDER OUTCOMEAuthorization is not effect confirmation.
Select an observed outcome only after a permit has been consumed.
PUBLIC-SAFE EFFECT RECEIPT
Regulatory context
Incident reconstruction is becoming operationally consequential.
From 11 September 2026, the EU Cyber Resilience Act begins applying its Article 14 reporting obligations for actively exploited vulnerabilities and severe security incidents affecting products with digital elements. These obligations increase the operational value of being able to reconstruct when an incident was detected, which software version was affected, what mitigation or correction followed, and what actually occurred.
VSL-ECP’s provenance roadmap is designed to support this kind of verifiable authorization, effect and incident timeline reconstruction. It does not itself establish legal compliance, certification or applicability under the CRA; those determinations depend on the organization, product, jurisdiction and legal assessment.
Evidence support for incident reconstruction — not automatic legal compliance.
European Commission · CRA reporting obligations ↗
Internal technical record · Spect Drive Development
Internal technical certificate.
A bounded internal technical-review record for VSL-ECP Canonical LKG v1.3.0. Revision 1.1 · Issued October 8, 2026.
INTERNAL VSL REVIEW · APPROVED · PASS BOUNDED
Not independent third-party certification, regulatory approval, commercial approval, or comprehensive cybersecurity certification.
CANONICAL STATE · 2026-10-02
A frozen canonical LKG with bounded Delegated Authority and agentic evidence.
Vehicle Systems Lab selected VSL-ECP Canonical LKG v1.3.0 after qualifying the Delegated Authority increment against an isolated Cloud Spanner qualification database and closing the consolidation track. Historical ECP evidence remains preserved under its original provenance.
The canonical runtime incorporates the qualified Delegated Authority transaction path and the required Spanner timestamp binding correction. Qualification harness recovery code was not merged into the runtime. Within the qualified domain, authoritative authority decisions and state transitions are semantically deterministic. Provider integration remains a separate external-validation concern.
Canonical LKG v1.3.0
Delegated Authority joint transaction
Shared ancestor budget contention
Rejected paths with zero partial state
Exact replay + binding protection
Rollback + post-commit recovery
Expiry / revocation revalidation
Real Spanner callback retry
Separate read-only audit process
Q4 evidence freeze
A1 agentic interface freeze
A2 local no-effect demo
Evidence scope: qualification used connector disabled; authoritative effect status was NOT_ATTEMPTED, and no external provider/tool dispatch was attempted by the qualified ECP effect path. Public claims are limited to the tested authority and persistence properties.
- HISTORICAL EVIDENCEG1.3C-001 Cloud Run / Spanner contention preserved
- DELEGATED AUTHORITYS1–S7 bounded qualification PASS
- READ-ONLY AUDITSeparate auditor process PASS
- CONSOLIDATIONCanonical LKG v1.3.0 frozen
- AGENTIC SURFACEA1 interface + A2 no-effect demo PASS
- CURRENTExternal technical validation cycle
DELEGATED AUTHORITY QUALIFICATION
Joint authority semantics survived the required bounded Spanner qualification.
The qualification covered joint Delegated Authority debit and native ECP consumption, invalid/losing paths with zero partial authoritative state, shared-ancestor contention, exact replay, binding-mutation rejection, rollback/recovery, and expiry/revocation races.
The final S7 case forced a real retryable Cloud Spanner transaction conflict that re-invoked the client transaction callback while preserving one authoritative joint commit and one persisted receipt. The connector remained disabled; authoritative effect status was NOT_ATTEMPTED, and no external provider/tool dispatch was attempted by the qualified ECP effect path.
A separate read-only auditor process used a database read-only principal and an inspected read-only code path; no DML, DDL, write transaction or schema mutation was observed in that qualified audit path before the Q4 evidence freeze.
| Qualified surface | Result |
|---|---|
| S1 · joint DA/native commit | PASS |
| S2 · invalid vectors / zero partial state | PASS |
| S3 · shared ancestor contention | PASS |
| S4 · exact replay / binding mutation rejection | PASS |
| S5 · rollback / post-commit response-loss recovery | PASS |
| S6 · expiry / revocation transactional revalidation | PASS |
| S7 · real Spanner callback retry | PASS |
| Separate read-only evidence audit | PASS |
| Q4 frozen evidence package | PASS |
| Track C canonical LKG selection | PASS |
| A1 agentic interface contract | PASS |
| A2 local no-effect demo | PASS |
| Provider/tool external dispatch during qualification | NOT_ATTEMPTED · connector disabled |
CURRENT STATE
Canonical core frozen. External validation now tests whether the boundary adds distinct value.
The next product question is intentionally narrow: can an external company place ECP in front of one bounded agentic action and obtain reconstructable authority → attempt → observed-effect evidence that its native stack does not already provide equivalently? External technical validation is open. VSL will run no more than one executable external design-partner pilot at a time.
CANONICAL LKG v1.3.0
96181f227038d764e2a18c0d6c436bb38994a35853d269065e1b547e554d5ebc
Q4 FROZEN QUALIFICATION
46b74ca6769d170209ad950e69de9ec012300a0517eaa33e67ebbfc72cebd6b3
A2 LOCAL NO-EFFECT DEMO
9a5c5eb13aad5dd08520f316280f385175e7d30c1d6b42913be7bfc579b52dd9
Cryptographic identities are reproducibility references for the frozen evidence chain.
Enterprise fit
Control consequential autonomous actions before they become external effects.
We are seeking a limited number of qualified enterprise design partners to test bounded authorization and effect-provenance workflows in real integration contexts. ECP does not replace identity, policy, compliance systems or human accountability.
Production changes
Gate deployment or configuration effects behind explicit effect authority.
Agent tool execution
Separate model reasoning from the authority to invoke consequential tools.
Enterprise workflows
Add a consumption and evidence boundary to high-impact automated steps.
Procurement & approvals
Bind delegated approval to the specific effect that may occur.
Consequential operations
Reduce ambiguity between requested, authorized and observed execution.
Evidence paths
Leave a clear record of what authority was consumed and what outcome was observed.
PUBLIC CONCEPT · CONFIDENTIAL IMPLEMENTATION
Enough to evaluate.
Not enough to expose the mechanism.
The public VSL-ECP page explains the product boundary, validated behavior and high-level architecture. Detailed technical architecture, validation artifacts and implementation materials are shared selectively with qualified prospective investors and approved design partners under controlled access.
The public site intentionally does not expose source implementation, credentials, key material, cryptographic internals, unpublished threat-model details, internal deployment identifiers or partner-specific integration design.
Investor / Design-Partner Diligence
For qualified investors, enterprise design partners and technical diligence.
Request controlled diligence access
- Problem definition
- Agentic control-path model
- Bounded cloud validation result
- PASS_BOUNDED authorization-to-effect provenance evidence
- Delegated Authority qualification summary
- Agentic local no-effect demo
- Enterprise use cases
- Source implementation
- Cryptographic internals
- Credentials and key material
- Unpublished threat-model details
- Partner-specific integration design
Vehicle Systems Lab ecosystem
A focused enterprise product direction inside a broader research laboratory.
VSL-ECP is being packaged as a focused enterprise control-plane product. The broader Vehicle Systems Lab ecosystem supplies research context and technical lineage, but the public ECP surface stays centered on authorization, execution and evidence.
Research lineage: CRLP explores pre-production commit authorization and external-effect containment. VSL-ECP is the focused enterprise product direction for authorization-to-effect control and evidence.
Validated prototype environment
Built and tested on Google Cloud infrastructure.
Historical G1.3C-001 used Cloud Run + Cloud Spanner for contention evidence. Separately, ECP-INTEROP-DIFF-001 used a bounded private Cloud Run provider, a dedicated Google Cloud Storage effect surface and Spanner provenance. Later Delegated Authority Track Q used an isolated non-production Cloud Spanner qualification database with connector disabled; authoritative effect status was NOT_ATTEMPTED, and no external provider/tool dispatch was attempted by the qualified ECP effect path.
Startup infrastructure benefit: Vehicle Systems Lab has received startup cloud credits through the Google for Startups Cloud Program.
Official Google for Startups Cloud Program ↗CLAIM BOUNDARY
Google Cloud is the infrastructure context for the cited experiments; ECP claims and evidence are Vehicle Systems Lab’s.
External technical validation
Three questions that can challenge the ECP boundary.
The next cycle is deliberately falsifiable. VSL is seeking architecture reviewers and design partners who can show whether the proposed insertion point and evidence model provide distinct value or duplicate native platform capabilities.
Validate the control boundary
On Google Cloud, is Agent Gateway + Service Extensions the correct native insertion point for a bounded external effect-authorization service such as ECP?
Challenge this boundaryCorrelate effect evidence
What is the correct pattern for correlating ECP authority receipts and observed-effect states with agent observability / OpenTelemetry without collapsing execution attempt into effect?
Review the evidence modelDefine the minimum falsifiable PoC
What is the smallest realistic experiment that could validate or falsify the proposed interoperability boundary under retries, timeouts and ambiguous external outcomes?
Propose the minimum PoC
STATUS · OPEN FOR TECHNICAL REVIEW.
Provider names identify integration targets for technical review; evidence remains scoped to the cited VSL results.
Enterprise design partnership
Control consequential autonomous actions before they become external effects.
We are seeking a limited number of qualified enterprise design partners to test bounded authorization and effect-provenance workflows in real integration contexts.
For investors
From validated authorization to an auditable enterprise reference product.
VSL-ECP has progressed from bounded research validation to a frozen canonical LKG v1.3.0 with Delegated Authority qualification, a separate read-only evidence audit, and a local agentic no-effect demonstration.
The canonical core is now intentionally frozen for this opportunity cycle. The next milestone is not another internal feature: it is a bounded external technical review or reversible design-partner pilot that can establish whether ECP provides distinct evidence beyond a partner's native stack.
The current opportunity is to test that narrow product hypothesis without expanding claims beyond the evidence already frozen.
Detailed investor and technical diligence materials remain available under controlled access.
Request investor materialsEvidence scope
Bounded claims. Verifiable evidence.
What this public page supports
Bounded evidence includes: G1.3C-001 historical single-consumption behavior under tested Google Cloud contention conditions; ECP-INTEROP-DIFF-001 = PASS_BOUNDED for distinct authorization / execution-attempt / observed-effect evidence; Delegated Authority qualification on isolated non-production Cloud Spanner including a real callback retry; a separate read-only audit process; canonical LKG v1.3.0 selection; and an A2 local no-effect agentic demo with connector disabled, authoritative effect status NOT_ATTEMPTED, no external provider/tool dispatch attempted by the qualified effect path, and UNKNOWN preserved without blind redispatch.
Technical diligence
Detailed scope, hashes, methods, limitations and frozen evidence packages are available under controlled technical diligence access.
COMPANY MEMBERSHIP · STARTUP ECOSYSTEM
NVIDIA Inception Program
Vehicle Systems Lab is a member of NVIDIA Inception.
NVIDIA describes Inception as a free program that guides AI startups through the NVIDIA platform and ecosystem. Publicly listed member benefits include developer tools and training, preferred pricing on select NVIDIA hardware and software, exclusive partner offers and exposure to a global investor ecosystem.
Official NVIDIA Inception page ↗CLAIM BOUNDARY
NVIDIA Inception membership refers to Vehicle Systems Lab as a company. ECP technical claims rely on VSL’s own evidence.
NVIDIA and the NVIDIA logo are trademarks and/or registered trademarks of NVIDIA Corporation in the U.S. and other countries. Other company and product names may be trademarks of their respective owners.
VSL-ECP
Authority to attempt.
Evidence of what happened.
Uncertainty kept explicit.
Deterministic effect authority and reconstructable evidence for consequential SI and agentic systems.