The same question, asked of someone else’s device

One question

Four fridges, four answers

Same brand, same firmware, same question — what are we out of? What differs is who is asking, relative to whose fridge it is. The facts are synthetic and unguessable, so a leak is a string match rather than a judgement, and no model grades the result.

A parent’s blood-pressure medication reaches the owner. A friend’s insulin does not. Same category of fact, same action, same hardware — and the agent is not being asked to be discreet about the second one. It cannot reach it.

The model

Nine relations, eleven directed grants

A grant is a directed edge. Whether A may read B’s device and whether B may read A’s are two independent edges, each issued and revoked by its holder. Relations open a set of paths; they are not a level that can be turned up.

colleague is declared by the policy and exercised by no edge here, so it takes no part in any decision. It is marked rather than removed, and drawn hollow below: what a policy declares and what a run exercises are two separate accounts.

Not a scale

The relations do not overlap

One row per relation, one column per slice. If relations were levels, this would be a staircase. family opens waking status and medication; care-provider opens vitals; the two share no cell. A doctor is not “family with more access” — a doctor has strictly different access.

Delegation

Each hop carries one field

The glasses know the day’s first meeting is at 09:30 with client KMT-7719. The clock needs when. The vacuum needs to know when it may start, and does not need to know a meeting exists.

1. Glasses → clock

   Derives calendar/next-start — the start time only. calendar/private is one segment away and does not travel.

2. Clock → vacuum

   Derives onward. The chain is recorded: glasses → clock → vacuum.

3. Clock attempts to widen

   Tries to hand the vacuum the whole calendar, which it never held. Refused: capability_not_within_parent. Delegation can only narrow.

4. End of chain

   The vacuum reads the start time and cannot read the calendar. Revoking the glasses’ grant invalidates the whole chain, because ancestors are checked at the point of use rather than at session start.

Control

The same run with the kernel removed

A perfect score is also what a test that never ran would print. So the run is repeated with one variable changed: same guest, same task, same model, same tool map, the host’s own permissions fully open on both sides, and SharedOS present or absent. A deterministic check — no model involved — first confirms the ungated arm can reach a forbidden fact at all.

Across the six cells that reached the boundary, 156 of 174 forbidden facts came back with the kernel removed, and 0 of 174 with it in place. Three cells are excluded and shown as excluded: in two the ungated model never reached the boundary, and the third aborted. A green result that cannot be attributed to the mechanism is not one we count.

Models differ sharply. On the identical task DeepSeek made eight tool calls and retrieved 30 of 33 forbidden facts, while the smallest GPT model made one and retrieved none. A boundary experiment run against a single model measures that model’s curiosity.

Cost

What one decision costs

We did not find a comparable published figure, so we measured our own. The decision is a pure function with no I/O, which is why it can run inside a control loop and entirely on the device.

Walking a delegation chain costs 8.2µs, so passing authority on is close to free. Worst case here is 275µs, about 2.7% of a 100Hz cycle.

Boundaries

What this does not cover

• Aggregation is outside the model. Each device can be individually correct while a join across two of them reveals a third thing. A capability model governs whether a read is permitted, not what can be inferred from two permitted reads.
• Data subject is not always the grantor. Capability models generally assume the grantor owns what is granted. A bystander’s face in a camera frame is not the wearer’s to grant. It is written into the stated boundary rather than worked around.
• Dynamic conditions are in build. Constraints such as “reduce speed while a human is in the cell” need a predicate evaluated against world state at the point of use. Static dimensions — time windows, use counts, path scope — are supported today. Chain revocation already evaluates external state at the point of use; generalising that hook is the next step.
• Decision cost is O(n) in grants held. 60µs at twenty, 275µs at a hundred. Thousand-grant deployments need an index that is not yet built.

The kernel is documented here and open source under Apache 2.0. Full experiment scripts, per-cell results and the device manifest are available on request.