hawkes.aiKey ideas
- The one idea — Validating a strict message format against a grammar, with a deterministic parser at the boundary that drops anything malformed, is an old, battle-tested security idea — it came from hardening industrial control systems (the Wurldtech / Achilles lineage). LLM agents rediscovered a proven discipline.
- How it is shown — Protocol frames validated against a grammar at the wire — malformed or out-of-spec traffic dropped before it ever reaches the controller.
- The trap to avoid — Thinking constraining an AI's actions is a brand-new problem. It's an old one; the frontier is applying wire-level input validation to a new kind of actor.
- What it sets up — Act 9 (Trust) closes: soft models.
Long before AI agents, engineers guarded power plants with a strict parser at the boundary that dropped every malformed message. AI safety just rediscovered their playbook.
The one idea
Validating a strict message format against a grammar, with a deterministic parser at the boundary that drops anything malformed, is an old, battle-tested security idea — it came from hardening industrial control systems (the Wurldtech / Achilles lineage). LLM agents rediscovered a proven discipline.
This idea isn't new. Before it ever guarded an AI, it secured power plants. Grammar-based validation by a deterministic parser at a boundary is an old, battle-tested discipline. LLM agents didn't invent it — they rediscovered it. The world it was forged in: industrial control systems speak rigid protocols to physical machinery — valves, turbines, the grid. A single malformed message can crash a controller or wrench a real process off its rails. The stakes are physical, so that world got serious early about which messages it accepts. The defense: validate every protocol frame against a strict grammar at the wire, before it reaches the controller.
How it works — the demo
Protocol frames validated against a grammar at the wire — malformed or out-of-spec traffic dropped before it ever reaches the controller.
A deterministic parser drops anything malformed; only in-spec traffic gets through — exactly the pattern from the last two episodes: a grammar, a dumb parser, a hard boundary. This heritage even has a name: Wurldtech, whose Achilles platform hardened industrial devices by hammering them with malformed traffic and validating protocols against a grammar — proven enough to be acquired by GE. So enforcing an AI action grammar with a deterministic checker isn't shaky new ground; it's a documented industrial pedigree. And it's the same shape exactly: a whitelist of legal message-shapes, a deterministic parser, a hardened boundary. Only the actor changed — a physical controller became the world an AI agent acts on. The agent is just a new source of untrusted messages, and we've validated those at a boundary for decades. The trap: thinking constraining an AI's actions is a brand-new problem. It's an old one — validating untrusted input at a boundary — pointed at a new actor.
The trap to avoid
Thinking constraining an AI's actions is a brand-new problem. It's an old one; the frontier is applying wire-level input validation to a new kind of actor.
Why it matters — and what’s next
Act 9 (Trust) closes: soft models.
The frontier isn't inventing the technique; it's applying a proven one. The lesson of this whole act: don't conjure new guarantees, inherit the ones that work. So Act nine, on trust, closes here. Soft models mean you ground guarantees in structure and the world: measure honestly with evals, then make dangerous actions impossible — grammars, executors, deterministic checkers, a lineage proven in power plants. But principles aren't a system. How does this get built into a real, working agent? Next act: our own systems, starting with R1.
This is one short episode in AI: Zero → Frontier, a step-by-step climb through how AI actually works. Each episode builds only on the ones before it.
Full transcript 2:30 of narration
This idea isn't new. Before it ever guarded an AI, it secured power plants. Grammar-based validation by a deterministic parser at a boundary is an old, battle-tested discipline. LLM agents didn't invent it — they rediscovered it.
The world it was forged in: industrial control systems speak rigid protocols to physical machinery — valves, turbines, the grid. A single malformed message can crash a controller or wrench a real process off its rails. The stakes are physical, so that world got serious early about which messages it accepts.
The defense: validate every protocol frame against a strict grammar at the wire, before it reaches the controller. A deterministic parser drops anything malformed; only in-spec traffic gets through — exactly the pattern from the last two episodes: a grammar, a dumb parser, a hard boundary.
This heritage even has a name: Wurldtech, whose Achilles platform hardened industrial devices by hammering them with malformed traffic and validating protocols against a grammar — proven enough to be acquired by GE. So enforcing an AI action grammar with a deterministic checker isn't shaky new ground; it's a documented industrial pedigree.
And it's the same shape exactly: a whitelist of legal message-shapes, a deterministic parser, a hardened boundary. Only the actor changed — a physical controller became the world an AI agent acts on. The agent is just a new source of untrusted messages, and we've validated those at a boundary for decades.
The trap: thinking constraining an AI's actions is a brand-new problem. It's an old one — validating untrusted input at a boundary — pointed at a new actor. The frontier isn't inventing the technique; it's applying a proven one. The lesson of this whole act: don't conjure new guarantees, inherit the ones that work.
So Act nine, on trust, closes here. Soft models mean you ground guarantees in structure and the world: measure honestly with evals, then make dangerous actions impossible — grammars, executors, deterministic checkers, a lineage proven in power plants. But principles aren't a system. How does this get built into a real, working agent? Next act: our own systems, starting with R1.