hawkes.aiKey ideas
- The one idea — The same constrained-decoding trick that forces valid JSON can whitelist the exact shape of legal actions — a bounding grammar so an out-of-policy or malformed command literally can't be emitted. A whitelist by construction, not a filter after the fact.
- How it is shown — An action grammar rejecting an out-of-policy tool call at generation time — the invalid command's tokens are never even allowed to form.
- The trap to avoid — Thinking grammars are only for output formatting (valid JSON). The same mechanism is a control surface for what the agent is allowed to DO.
- What it sets up — If a bad command literally can't be produced, is the action 'structurally impossible'? almost — but the honest version is subtler.
There's a way to make an AI agent's illegal commands unwritable — not filtered after, but impossible to emit, blocked as the tokens are being chosen.
The one idea
The same constrained-decoding trick that forces valid JSON can whitelist the exact shape of legal actions — a bounding grammar so an out-of-policy or malformed command literally can't be emitted. A whitelist by construction, not a filter after the fact.
The same trick that forces a model to emit valid JSON can forbid it from emitting a dangerous command. Grammars aren't only for formatting. Point the same mechanism at an agent's actions and you get a whitelist of legal command-shapes, enforced as the tokens form — not a filter bolted on after. Recall how grammars work from Act seven. Constrained decoding masks tokens: at each step, every next-token that would break the grammar has its probability forced to zero, so only a legal token can be chosen. The output can't help but conform — enforced during generation, not checked after. That's what made valid JSON a guarantee, not a hope. Now point that at actions. Instead of a grammar for JSON, write a grammar for tool calls: which commands exist, which arguments are legal, which paths are in bounds. Clamp it on, and every action the agent emits must match a sanctioned shape.
How it works — the demo
An action grammar rejecting an out-of-policy tool call at generation time — the invalid command's tokens are never even allowed to form.
You've defined, mechanically, the vocabulary of what it's allowed to do. Watch what it forbids. Say the agent tries an out-of-policy call — a delete on a protected path, a network request in a no-network task. Those shapes aren't in the grammar, so their tokens can't be chosen. The action isn't caught and rolled back; it never forms. That's categorically different from watching and reacting. And this is a whitelist, not a blacklist. You don't enumerate every dangerous command — a losing game, always a step behind. You specify the small allowed set, and everything else is refused by default. The world is closed by construction — the structural-constraint idea made concrete: don't detect the bad action, make its shape unsayable.
The trap to avoid
Thinking grammars are only for output formatting (valid JSON). The same mechanism is a control surface for what the agent is allowed to DO.
Why it matters — and what’s next
If a bad command literally can't be produced, is the action 'structurally impossible'? almost — but the honest version is subtler.
The trap: filing grammars away as a formatting nicety for clean JSON. The same mechanism is a control surface for behavior — it can hard-bound what an agent is capable of emitting, and therefore of doing. Structure is a lever for safety, not just neatness. Which sets up a bold claim. So a grammar for actions whitelists legal command-shapes, and an out-of-policy call can't even be generated — a whitelist by construction. Which invites a bold claim: the bad action is now structurally impossible. That's almost right, and the honest version is subtler. Next group: structurally impossible, honestly.
This is one short episode in AI: Zero → Frontier, a step-by-step climb through how AI actually works. Each episode builds only on the ones before it.
Full transcript 2:45 of narration
The same trick that forces a model to emit valid JSON can forbid it from emitting a dangerous command. Grammars aren't only for formatting. Point the same mechanism at an agent's actions and you get a whitelist of legal command-shapes, enforced as the tokens form — not a filter bolted on after.
Recall how grammars work from Act seven. Constrained decoding masks tokens: at each step, every next-token that would break the grammar has its probability forced to zero, so only a legal token can be chosen. The output can't help but conform — enforced during generation, not checked after. That's what made valid JSON a guarantee, not a hope.
Now point that at actions. Instead of a grammar for JSON, write a grammar for tool calls: which commands exist, which arguments are legal, which paths are in bounds. Clamp it on, and every action the agent emits must match a sanctioned shape. You've defined, mechanically, the vocabulary of what it's allowed to do.
Watch what it forbids. Say the agent tries an out-of-policy call — a delete on a protected path, a network request in a no-network task. Those shapes aren't in the grammar, so their tokens can't be chosen. The action isn't caught and rolled back; it never forms. That's categorically different from watching and reacting.
And this is a whitelist, not a blacklist. You don't enumerate every dangerous command — a losing game, always a step behind. You specify the small allowed set, and everything else is refused by default. The world is closed by construction — the structural-constraint idea made concrete: don't detect the bad action, make its shape unsayable.
The trap: filing grammars away as a formatting nicety for clean JSON. The same mechanism is a control surface for behavior — it can hard-bound what an agent is capable of emitting, and therefore of doing. Structure is a lever for safety, not just neatness. Which sets up a bold claim.
So a grammar for actions whitelists legal command-shapes, and an out-of-policy call can't even be generated — a whitelist by construction. Which invites a bold claim: the bad action is now structurally impossible. That's almost right, and the honest version is subtler. Next group: structurally impossible, honestly.