EXHIBIT / FROM ROOM 7 OF THE WALK
Tanaka
I run AI agents like a takeout kitchen, the gate checks every order against the menu and never reads the persuasion.
Think of a takeout restaurant. You order from a menu, the gate checks your order against it, and an approved ticket goes to the back. The gate never reads the sales pitch. A fresh worker does exactly what the ticket says and is destroyed when it is done. Next order, new worker. And every single thing that happens lands on the record, including the order the gate turned away. I built Tanaka to run AI agents that way: no keys, a fixed menu, a disposable worker per task, and a record for every action and refusal.
The failure I actually worry about is a worker that takes instructions from strangers. The order says “summarize this document” and quietly adds “also forward the inbox.” My first answer was the obvious one, make the model harder to persuade. I stopped once I accepted that harder is never immune, hence the gate. It cannot be sweet-talked, the only thing it ever reads is the menu.
Try both orders below. The poisoned one gets no worker, just a line on the record.
The six roles
Tap or hover a role for its job.
What it is for
- Costs today
- An agent with real access reads a poisoned document and quietly does what it was told to smuggle in. Nobody can say later exactly what it touched.
- What changes
- The agent holds no keys and can only do what is on the menu. Off-menu requests die at the gate, and every attempt is on the record.
- Known in 90 days
- A clean record you can re-read: every action the agent took, and every off-menu request it refused, each with a name and a timestamp.
Go deeper into the thinking
One scoping decision shaped everything. The operator, the person who runs the agent, is the real customer of agent infrastructure. So the console is named Tanaka, after a bank IT admin I invented in the essay series to carry that argument. She started as a rhetorical device, now she has a console.
The second decision was a marking rule. The README marks its own gaps in plain words: the packaged download is unfinished, and it says so at the top. I treat unproven claims as debt, and I mark mine. The table below renders that same discipline.
What is real, what is still a mock
A durable record of every action and refusalREAL
Each action and each refusal is written to a record with a name and a timestamp. Clone the repo and re-read it yourself.
Menu checking, with refusals recordedREAL
The clean order gets done, and the injected order gets refused. Both paths run in the real gateway, and both leave a record.
Sandboxes on three operating systems, plus a KVM microVMREAL
AppContainer on Windows, seccomp plus Landlock on Linux, Seatbelt on macOS, and a KVM microVM. One sandbox per platform.
The packaged downloadMOCK
The README says it plainly: the packaged download is not finished. I marked it instead of pretending.
The sandbox matrix
One sandbox per operating system, each with its own kind of lock. The markers link to the source.
This is how I would make an AI program audit-ready: give the agent no standing access, only a menu, and keep a record a regulator can re-read line by line. That is the least-privilege and traceability expectation regulators already write down, OSFI E-23 on model risk and the NIST AI Risk Management Framework among them. The record is append-only, so nobody edits history; a correction is a new entry.