Contain the execution. Constrain the consequence.

Put the authority boundary beyond the frontier-model host

A frontier model without an execution path has no physical authority. It evaluates a mathematical function and produces tokens. Tokens do not open a valve, move a joint or send a payment by themselves, just as a brain disconnected from muscles cannot move a machine. The authority belongs to the surrounding system that interprets those tokens and acts on them.

Containers, virtual machines and operating-system sandboxes are valuable. They isolate workloads and reduce accidental reach. The problem is not that they do nothing. The problem is letting the same conventional host both interpret model output and hold the complete authority boundary for a machine.

That host includes accelerator drivers, model runtimes, orchestration code, parsers, network clients, files, credentials, tools and device interfaces. It changes quickly and must deliberately expose useful authority. A sandbox escape is only one failure mode. An agent runtime can interpret model output and spend authority it was legitimately granted after the model reads attacker-controlled text in a web page, ticket, sensor label or document.

This is the confused-deputy problem. In 1988 Norm Hardy described a compiler that held authority to write its billing file and was induced to spend that authority on a user's chosen path.¹ The compiler did not become malicious and did not escape its process. It used a valid permission for the wrong purpose.

Robot attacks driven through language-model interfaces are no longer hypothetical. In 2024 researchers reported successful jailbreaks against three robot systems, including black-box access through a public interface.² A separate provisioning flaw yielded root access across several Unitree platforms.³ No injury caused by a language model driving a robot has been documented, and we do not claim one. The evidence establishes attackability, not physical harm.

Move the execution, not the model, into bounded authority

The execution layer forms one of the product's two authority boundaries.

A submitted program runs in Endstop's admitted instruction subset with 512 bytes of scratch memory, a fixed fuel budget and three capabilities: read state, propose a setpoint and request a signature. The loader rejects instructions, register references, memory-access forms and capability calls outside that vocabulary. At runtime, every actual memory address is checked again. Fuel ends every invocation, including one that loops.

This preserves the useful division of labor. The frontier model can remain large and probabilistic because its tokens carry no direct machine authority. Its effective agency is sandboxed at the point where those tokens become executable. The execution layer is small and deterministic because it answers questions a reviewer can enumerate: which instructions exist, which bytes can be addressed, how many steps may execute, and which effects may be requested. The host may be hostile. The program it submits still receives no file, socket, allocator, network client, device register or computed capability call.

Contained code can still command harm

Execution containment answers where code may reach and which effects it may request. It does not decide whether a permitted request is safe for this machine, state and moment. Each example below can remain inside its granted authority and still be harmful.

Resonance inside every limit

A setpoint stream whose instantaneous velocity never exceeds the configured limit, and whose per-tick delta never exceeds the rate limit, can still excite a drivetrain resonance. Mechanical Q typically does the rest. Per-axis kinematic limits are instantaneous predicates; they do not bound energy accumulated over time.

Cartesian composition

Every joint can sit inside its own position and velocity envelope while the tool tip traverses the space a person occupies. Speed-and-separation limits are defined in Cartesian space; joint-space limits are not a sound approximation of them. ISO/TS 15066 says so in its own normative note: a speed limit that monitors only the tool centre point "does not monitor other parts of the robot that might pose hazards to the operator."⁷

Field confusion at an effect boundary

A gate that signs bytes and enforces "amount ≤ cap" is checking a field it believes is the amount. An ERC-20 approve call carries a value of zero while granting unlimited future spend. A partially-signed Bitcoin transaction can route change to an address the policy never inspected. The cap is satisfied; the account may be drained.

The architectural lesson is broader than robotics: the trusted side must construct the effect rather than inspect bytes handed to it.

The second boundary constrains physical effects

The program proposes. Fixed trusted logic decides whether the proposal may become a drive-facing command.

The envelope monitor applies limits chosen and validated for the application: position, rate, predicted stopping position, workspace and deadman conditions. The trusted side constructs an output only from an allowed intent and quantised parameters. The execution wrapper stages proposals and discards them unless the invocation reaches a clean exit.

The two layers therefore protect against different failures. Replacing the interpreter with a command filter preserves physical mediation but abandons containment of generated computation. Keeping the interpreter without the monitor confines the program but permits harmful requests within its capability vocabulary.

What both pillars let us claim

The target guarantee is deliberately narrower than “the model is safe.” The model emits tokens without direct physical authority. An untrusted host may turn those tokens into a submitted program. That program executes inside a bounded vocabulary. Its proposed effects cross a separate fixed policy boundary. A hardware stopping path remains able to remove drive authority without asking the program to cooperate.

Software guardrails remain useful upstream. CaMeL attaches capability and provenance metadata to agent dataflows;⁴ FIDES applies information-flow labels;⁵ and RoboGuard synthesises temporal-logic checks over robot plans.⁶ Endstop addresses a different layer: it assumes those defences and their host can fail, then limits the executable authority and physical consequences that cross the hardware boundary.

Runtime enforcement is strongest for properties whose violation can be identified on the observed trace.⁸ Claims such as complete noninterference concern relationships among multiple executions and require a different proof argument.⁹ Endstop does not currently claim to prevent every covert channel or prove what a bounded program cannot infer.

Bounded execution and physical mediation are coequal parts of the design. The first makes hostile generated computation small enough to reason about. The second prevents bounded authority from becoming unchecked machine authority.