Introducing TARG

01Six stages, every operation

The shipped gate evaluates every tool operation in sequence, short-circuiting on the first stage that objects:

Every stage decision lands in a bounded audit record — the same records the orchestration graph carries as its policy section, and the A2F .orch export serialises.

02Budgets, and the record

Two of the six stages deserve their own paragraph, because they are where guardianship becomes measurable. Scope is a per-session ration: every tool carries a budget, spent call by call, and an exhausted ration refuses further use of that tool for the session — which converts abuse from something detected afterwards into something arithmetically impossible. Policy inspects the operation’s own arguments for destructive patterns, so even an entitled, in-budget request is refused when what it says crosses a line — the authority of the asker never launders the content of the ask.

And every stage decision — pass, flag or block — lands in a bounded audit record. That record is not private telemetry: it is the policy section of the Orchestration Graph, rendered in the Studio’s Work view and serialised into every A2F .orch export. Governance that cannot be inspected afterwards is a promise; governance on the record is a property.

03The block the intelligence can see

The design decision that carries the philosophy: a refusal is never a silent failure. When TARG blocks an operation, the block is returned to the intelligence as the operation’s result — named, explained, and visible — so the model can tell the visitor plainly what happened and offer another path instead of retrying into a wall or, worse, pretending success. Governance the governed can see is the kind that holds; it is the same discipline the truthfulness-weighted verification track of the Interactive Intelligence Benchmark scores from the outside. Safety, on this design, is a property of the architecture rather than a review performed after deployment: the analysis lives in the runtime’s structure, and the record it leaves can be checked while the system runs, not just once it has.

Silent failure is the characteristic failure of agentic systems: an operation quietly refused upstream, an agent that never learns it, and a confident report about work that never happened. Making the refusal part of the conversation removes the gap that fabrication grows in — the intelligence cannot credibly claim what it was just told, in so many words, did not run.

Many systems have agents. Governed agents are the ones you can trust with a surface.

04From gate to constitution

The six stages, the budgets and the audit record run today in LabsAI Studio, on every tool operation of every session — including operations arriving over PAP, which pass the same gate as spoken ones; a protocol is not a side door. The fuller guardianship the name reaches toward — planning tickets, environment-wide state, an agent constitution that makes the principles themselves inspectable — is in research and development at Labsintelligence. The published position is the direction of travel: as agents multiply, governance has to live where the work lives, and the runtime is the only place every operation is guaranteed to pass through.