SYSTEM · WHERE KORREX SITS

A sandbox decides what an agent may touch. Korrex decides whether the act was entitled.

Both are policy layers and they do not overlap. A network guardrail cannot tell you a $980 line breaches clause 7.2; an authority layer cannot stop an agent reaching an endpoint it should never have held.

THEY STACK · NEITHER SUBSTITUTES FOR THE OTHER
CONTAINMENT LAYER
Sandbox, policy engine, access proxy
ASKS May this process reach this endpoint, with this credential, from this network?
RULES FROM Configuration written by engineers and versioned in a repository.
KNOWS ABOUT Tools, tokens, hosts, scopes. Nothing about what the enterprise agreed to.
PRODUCES An allow or a block, and telemetry. Answers to security.
AUTHORITY LAYER
Korrex
ASKS Was this act entitled, under a term in force on the date it happened?
RULES FROM Terms authorised by a named human, compiled into versioned predicates. Nobody writes the rules by hand.
KNOWS ABOUT Agreements, standing, rate cards, categories, counterparties, money.
PRODUCES A verdict, with its citation where one is linked, a receivable, and a ruling queue. Answers to the agreement.
SYSTEM DIAGRAMONE JUDGEMENT · OR MARKED AS BYPASSING IT

Every path to spend passes through one judgement. Everything left of the gate proposes, everything right of it executes, and only one lane accepts input.

WHO PROPOSES KORREX · THE GATE WHO EXECUTES Agentsread what they may read,attempt to transact Suppliersissue paper, amend rates,invoice — or pre-check Operatorsraise work directly insystems they hold keys to Agreement registerterms extracted, versions authorised Compilationterm → versioned predicate + date Judgementagainst the rules in force on its dateALLOW · ESCALATE · DENY · HELD Continuous auditpractice drift · capability drift Assuranceitems · classes · drift · contestsONLY LANE ACCEPTING INPUT Advise — routes, never enacts 5 1 ERPpayables, POs, settlementdenial ≠ payable FMSassets, faults, dispatchsupplies tested facts WSMscheduling, attendancecompletion evidence 2 3 SKILLS CORPUS every agent, gated or not THE LIVING LOOP · ADVISE ROUTES · A NAMED HUMAN RULES → CLAUSE CORPUSthe agreement was silent or wrong.An amendment compiles a new rule. → AGENT ENGINEERINGthe agent was wrong, not the paper.Skill narrows; it may never widen. → STANDINGthe actor was never entitled to ask.Only the mandate holder may rule. 4 LEDGER · ONE APPEND-ONLY SEQUENCE Every verdict, ruling, amendment, self-narrowing and compilation is a sequenced act — every surface above is a projection, never a source. Nobody reads the ledger — they read a claim about it, and that is what makes the claim defensible.
1Every attempt arrives at the gate — agents, suppliers and operators alike. Nothing reaches an executing system unjudged. 2Allowed acts only pass outward. A denial never becomes a payable, a dispatch or a booking. 3State reads back continuously — this is what lets drift be seen between runs rather than at year end. 4The ruled change lands where the next run will meet it: a compiled clause, a narrowed skill, or a mandate re-granted. 5Advice compiles forward into the register. Past receipts stand; the class stops arriving.
Solid — advice routed to the party who can act. Long dash — the change landing back where the next run will meet it. Fine dash — the skills corpus: declared capability for every agent, reconciled against standing, and where a narrowed skill returns. Red — standing: the actor was never entitled to ask, and spend that reaches an executing system without traversing the gate at all.
THE SAME THING IN WORDSONE LANE ACCEPTS INPUT
WHO PROPOSES
Agents
Read every system they are entitled to read, then attempt to transact. Hold no standing to authorise themselves.
ATTEMPT →
Suppliers
Issue paper, amend rate cards, invoice against what they believe was agreed. May also check a draft before sending it.
DOCUMENT · INVOICE · PRE-CHECK ⇄
Operators & controllers
Raise work directly in the systems they hold credentials for. Judged, and — depending on posture — held.
REQUEST →
KORREX · THE GATE
Agreement register CONTENT
Documents held, terms extracted on arrival, versions authorised by a named human.
Compilation MECHANISM
Authorised term → versioned predicate with an effective date and a fixed evaluation order. Terms that cannot be tested emit nothing.
Judgement DETERMINISTIC
Every attempt put to the rules in force on its own event date. Same input, same verdict, a year apart.
Continuous audit DRIFT
Reads the executing systems between runs. Detects practice that has moved without paper, and capability that appeared without mandate.
Assurance THE ONLY INPUT
Items, classes, drift and contests awaiting a named human. Every ruling compiles forward; none rewrites history.
ALLOW ESCALATE DENY HELD
WHO EXECUTES
ERP
Payables, purchase orders, invoice settlement. A denied event never becomes a payable.
→ EXECUTE · ⇄ READ BACK
FMS
Assets, faults, dispatch, telemetry. Supplies the subject and boundary facts a rule tests against.
→ EXECUTE · ⇄ READ BACK
WSM
Workshop scheduling, attendance, completion evidence. Returns state that closes the event.
→ EXECUTE · ⇄ READ BACK
BACK TO THE AGENT A refusal carrying the bound it broke, its clause where one is linked, and the envelope that would pass — so a large class self-corrects on the same run with no human asked.
BACK TO THE SUPPLIER The same rules, shown before an invoice is sent. Clean invoices clear on the first pass; nothing was relaxed to achieve it.
BACK TO THE RULER Every ruling states a prediction, and is marked against what happened next. A ruling nobody executed reopens its class rather than quietly retiring.
ONE APPEND-ONLY SEQUENCE BENEATH ALL OF IT · THE SURFACES ARE PROJECTIONS, NEVER SOURCES
STACKED WITH A CONTAINMENT LAYEREACH CATCHES WHAT THE OTHER CANNOT
THE FAILURECONTAINMENT LAYERKORREX
An agent calls an endpoint it was never meant to reach Blocked. This is exactly what it exists for. Invisible. Korrex judges acts, not network reach.
A permitted call settles an invoice that breaches clause 7.2 Allowed. The call was well-formed and in scope. Denied, with the clause cited and the figure that would pass.
An agent holds a settlement tool no delegation covers Permitted if the scope was granted in config. Raised as capability drift before a single event uses it.
A supplier quietly amends a rate card Not in scope. It is a document, not a call. Ingested, sequenced, and held — unknown is not permitted.
Credentials leak and are used from an unknown host Blocked on network and identity grounds. Judged on entitlement only. If the act was within a mandate, Korrex has no reason to refuse it.

Containment answers to security. Korrex answers to the agreement — which is why its output is a receivable and a ruling, not a log line.

KORREX Paper 06 of 06 · Architecture scan@korrex.ai