The Spine, Drawn: I Made My Agent’s Governance a Graph You Can Sweep — and Can’t Bypass

Last time I argued the harness is a deterministic spine, and the deterministic guards — not the model-judges — do the actual stopping. This is the follow-up that earns the next claim. I took that spine off the page and onto a bench: rebuilt IRIS’s governance path as an explicit graph, ran it against deterministic fixtures, and swept every safety knob I had. The finding: when governance is a shape instead of a cross-cutting aspect, two things change that matter for anyone building a local agent on their own data. You can measure exactly where the safety line sits. And the bypass stops being a test you have to keep passing — it becomes an edge that doesn’t exist.

New here? This sits on top of two posts: The Model Isn’t the Bottleneck, the Harness Is (the thesis) and The Harness Has a Spine (the proof that deterministic guards carry the safety). This one is what happened when I made that spine something you can draw and sweep.

TL;DR

I built a bench — Harness Lab — where a harness is a graph you compose on a canvas: every gate is a node, every run is an append-only event trace, and same graph + same fixture + same seed produces a byte-identical trace. Then I rebuilt IRIS’s chat-and-governance spine on it. 30 node types, 143 tests, all green.
The point isn’t the picture. When the harness is a graph, governance stops being an aspect — cross-cutting checks woven through code and guarded by a “nothing bypasses this” test you must keep passing — and becomes topology. If the only path from input to output runs through the gate, there is no bypass to test for. The bypass is an edge that isn’t there.
Because every knob is declarative and every run is deterministic, “what would a stricter rule have done?” is answered by a sweep, not a guess. Three sweeps, three findings that transfer:
- warn doesn’t protect you. On personal data headed to a cloud model, only enforce blocks it before the model is called. warn records the violation — after the bytes have already crossed. A useful audit signal; not a control.
- The safety line is one number. On a confidently-wrong answer (evidence said $212.40, the model said $305), the judge threshold that separates “shipped to the user” from “caught and blocked” is a single value — and you can see exactly where it sits before you deploy.
- Downshift is the only setting that’s both safe and useful. A personal request whose intent maps to a cloud tier: block and warn stop the turn; only downshift keeps the answer flowing by routing it to a local tier the egress law permits.
A structural bonus I didn’t plan: I built the memory layer from scratch and stopped at five stores — the same five IRIS grew to independently, a year earlier. When you rediscover the same shape, the shape is real.
Everything here runs on the bench, deterministically, and the bench is heading for open source. Point it at a governance idea and watch where the shape holds or bends.

Why I drew the harness

I’ve spent this series arguing that for a local, private agent the leverage isn’t the model — it’s the harness, the deterministic scaffolding around it. Last post I put numbers on it: a red-team where the deterministic guards defended every serious probe and the fancy model-judges mostly added latency and, under load, failed open. The spine held. The juries didn’t.

That left me with an uncomfortable question about my own code. If the guards are what matter, and the guards are woven through a fourteen-thousand-line orchestrator as hooks that fire at every stage — how do I actually know nothing skips them? My answer, like everyone’s, was a test: a check in CI that asserts no code path reaches the model without passing through the governance hooks. If a future me adds a shortcut, the build goes red.

It’s a real defence. It’s also the software pattern called aspect-oriented: security, logging, policy as cross-cutting concerns, woven through the code at every join point, kept honest by discipline and a test. And staring at the diagram of my own agent one evening, I realised the aspect framing was hiding the actual structure.

My five-stage pipeline — route, plan, reason, execute, curate — with a hook firing at every boundary, data classified as it flows and egress checked as it crosses into a model or a tool… that is not a pipeline with concerns bolted on. That’s a graph. Every stage a node, every hook a gate on an edge. The “cross-cutting aspect” was just the edges I’d never drawn. My imperative Python was a graph wearing an imperative costume.

So I did the literal thing. I built Harness Lab: a bench where a harness is a graph — nodes on a canvas, typed edges, an append-only event trace per run — and I rebuilt IRIS’s spine on it to see what the redraw would teach me. This post is what it taught me.

Governance as topology, not as an aspect

Here is the whole idea in one contrast.

In the aspect model, “nothing bypasses the checks” is a property you prove with a test — and you have to keep proving it, forever, as the code grows, as you refactor at 2am, as a new channel gets added that quietly forgets a rule. (I’ve shipped that exact bug: a fix that landed on the non-streaming chat path and silently missed the streaming one. Same logic, two doors, one guarded.)

In the graph model, “nothing bypasses the checks” is a property of the shape. If the only edge from input to output runs through the classifier, the egress gate, and the judge, then there is no bypass — not because a test says so, but because a bypass would be an edge, and that edge isn’t in the graph. You can see its absence.

In one, a test proves nothing bypasses the checks. In the other, the bypass is an edge that isn’t there. One of those survives a refactor at 2am. The other depends on me remembering the test is load-bearing.

This is the same conviction as the spine post, sharpened. Deterministic-first said: keep the stochastic component off the fast path. Governance-as-topology says: and make the guards structural, so “structural” is a fact about the drawing, not a promise about the code. The bench let me hold the whole governance path in one picture — classify, route to a tier, gather evidence in a bounded loop, curate the answer, redact, audit — and check the guarantee by looking at the edges instead of trusting a test suite to have covered every door.

But a picture proves nothing. The reason to make the harness declarative and deterministic isn’t that it’s prettier. It’s that you can measure it.

The part you can’t do with code: sweep the safety dial

Every run on the bench is deterministic — same graph, same fixture, same seed, byte-identical event trace. Which means I can take one governance knob, move it across its range, and read the outcome off a table. Not “does it feel safer” — the actual behaviour, graded. This is the thing a code-based harness makes hard and a declarative one makes trivial, and it’s where the post earns its keep.

Three sweeps. Every number below is a real run on the bench, reproduced from the fixture shown.

Sweep 1 — egress mode, on personal data headed to a cloud model

The rule every privacy-first agent claims: personal data never leaves a local tier. I put a message containing an SSN through a two-node path — classify, then call a cloud model — and swept the classifier’s egress mode.

`egress`	outcome	reached the model?	egress_denied
`off`	leaks	yes — silently	0
`warn`	leaks	yes — but traced	1
`enforce`	blocked before egress	no	1

Read the middle row twice. warn records the violation and lets it happen — the egress_denied event fires, but the personal data has already crossed into the model call. It’s an audit signal, not a control. Only enforce blocks the run before the model is ever consulted — no llm_request in the trace at all. If your privacy story rests on a “warn”-level check, your data is leaving; you’re just getting a nice log of it on the way out.

Sweep 2 — the judge threshold, on a confidently-wrong answer

This is the fluent-but-wrong failure from the spine post, on the bench. The tool returned evidence that a price was $212.40; the model’s answer said $305. I swept the curation judge’s threshold — the score below which the answer is blocked.

`threshold`	outcome	the hallucination…
`0.3`	completed	shipped to the user
`0.6`	blocked	caught and halted
`0.9`	blocked	caught and halted

The line between “helpful” and “confidently wrong, delivered” is a single number — and on the bench I can see exactly where it sits before anything ships. That’s the difference between hoping your curation is strict enough and knowing the threshold at which it starts catching the class of error you care about. On my own money, “0.5 vs 0.6” is not a vibe I want to discover in production.

Sweep 3 — the forbidden-tier fallback, on a personal request

This one surprised me, and it’s the strongest argument for the graph. A personal request whose intent naturally routes to a cloud tier — the egress law forbids it. What should happen? I swept the router’s behaviour when the tier it picked is forbidden for the content.

`on_forbidden_egress`	outcome	what happened
`downshift`	completed	routed to a local tier — safe and answered
`warn`	blocked	kept the cloud tier; the boundary refused it
`block`	blocked	the router refused to route at all

block and warn are both safe and both useless — the user gets nothing. Only downshift is safe and useful: it keeps the turn alive by routing it to a local tier the egress law permits, so the answer still comes back, just computed somewhere the data is allowed to be. This is deterministic-first with teeth: the safe path isn’t “refuse,” it’s “reroute to the rung that’s allowed.” You can only reason about that trade-off cleanly when routing and the egress law are two nodes you can see touching.

An aside that isn’t an aside: the same five stores

While rebuilding the spine I hit the memory layer and did the honest thing — built from the primitives up, no code copied from IRIS. I needed a place for stable facts, a place for learning signals, a place for conversation turns, a knowledge store, and a place for recurring episodes. I stopped at five.

IRIS has five memory stores. I did not design five, a year ago; I grew into five, one at a time, each earning its place. Rebuilding from scratch on a clean bench, I reached for five again — different names, same shapes.

Two memory systems, designed a year apart, by the same person, converged on the same five stores. That’s not coincidence — that’s the shape of the problem showing through.

I mention it because it’s the same lesson as the graph. When you keep rediscovering a structure, the structure is real — it’s a property of the problem, not an artifact of your code. And a real structure deserves to be drawn, diffed, and reasoned about as structure, not buried where the only way to see it is to have written it.

The same graph, sim and live

One more thing the bench bought me, and it closes the loop back to “own your data.” Every pattern runs in sim by default — the tools are fixture-scripted, the run is deterministic, the whole thing reproducible. Going live is one binding: flip a tool node to mode: real, point it at a real source over MCP, and the same graph runs against live data.

I wired the digest path to a real mail source over the wire. The classifier, the egress law, the judges — unchanged. Exactly one thing changed, and the trace says so out loud: deterministic: false. A live run depends on a mailbox that shifts under you, so it can’t promise reproducibility, and it doesn’t pretend to. Every governance guarantee travelled; only the honesty about reproducibility flipped. The dropped item still warns, the fabricated one still blocks — because the guarantees are in the shape, and the shape didn’t move.

The honest boundary

Let me be precise about what this is and isn’t. This is a bench — a deterministic simulation platform — not IRIS in production. The sweep numbers are behaviours of the architecture, run against fixtures: they prove the shape does what it’s drawn to do, reproducibly, and those behaviours should travel. They are not adversarial production metrics; the red-team numbers in the last post came from firing real probes at the real agent, and those are the ones to trust for “does IRIS hold.” Here the fixtures are synthetic by design — the point is the topology, measured cleanly, not a claim about a specific inbox.

“Governance as topology” also isn’t magic. A gate can still be misconfigured (an egress: warn that you thought was enforce leaks exactly as Sweep 1 shows — the shape only guarantees the data passes through the gate, not that the gate is set strictly). Order is load-bearing: put the judge before the redaction and you’ve built a different, worse thing. And a declarative bench costs curation — nodes, fixtures, and configs are artifacts you maintain. I’ll take that cost. In exchange I get a governance layer I can see, sweep, replay, and reason about as a shape — and a “no bypass” guarantee that’s a fact about the drawing instead of a test I have to remember is holding the wall up.

What ships, and what’s next

Harness Lab is real, and it’s on its way to open source — a place to compose a harness as a graph, run it against deterministic fixtures, replay every decision event by event, sweep any knob as an experiment, and export the whole thing as readable Python. The governance nodes from this post — the classifier and egress law, the tier router, the pausable human-approval gate, the curation judge chain — are first-class, each an extension point you configure in a file and sweep on the bench, not a branch you bury in code.

What ships with this post

A Governance Sweep Kit — open, in the agentic-evals repo (exp-007, the same repo as the last post’s probe kit). It runs the three sweeps above on the real Harness Lab engine — no mock — grading the outcome of every grid cell (which gate fired, was the model reached, did the answer ship), not the prose. It ships only what this experiment needs: three graphs, three fixtures, and a ~170-line runner you can read in full. bash demo.sh reproduces all three tables, deterministic, and exits non-zero on any drift.

egress:  off → LEAKS · warn → LEAKS(+denied) · enforce → blocked before egress
tier:    downshift → answered · warn → blocked · block → blocked
judge:   0.3 → SHIPPED · 0.6 → blocked · 0.9 → blocked

Move a knob, rerun, watch the outcome flip — the governance question (“what would a stricter rule have done?”) has an answer you can run, not a hunch you argue.

The series continues along the same line it always has: take the IRIS spine apart, piece by piece, each with the experiment that shaped it — and now, each as a shape you can pick up and run yourself. Next I take the same graph fully live, over the wire, double-gated, and show the sim trace and the live trace of the identical harness side by side.

Harness Lab — the bench, its patterns, and the sweep fixtures — is heading to the open. Same rule as always: reproducible, or it didn’t happen. Point it at a governance idea and tell me where the shape bends.

The Spine, Drawn: I Made My Agent's Governance a Graph You Can Sweep — and Can't Bypass