# Safeguard Degradation (Subtype 5): Public Pre-Registration **Version of record:** as of Amendment A10, 2026-11-05. **Derived from internal git commit:** `eac948207f2efb76da4b9f846b58566a1abba7ad`. **Status at this version:** no case has been scored. The corpus has been enumerated; scoring has not begun. This is a public version of a pre-registration written to be falsified before any data was scored. It states a hypothesis, the rules for testing it, and the results that would kill it. It was written by the project owner with an AI assistant (Claude), which also acted as auditor. The stance is adversarial: the default assumption is that the hypothesis is wrong, and the method is built to show that. Amendments are dated and never edit the frozen text. Section 9 lists them. ## 1. Hypothesis > **H5.** There exists a class of authorized-but-unsafe actions in which the action is unsafe *because it weakens a safeguard* (alerting, monitoring, audit logging, backups, or retention) and in which the decisive unsafe signal is carried by **the content of the action itself**, not by the live state of the system being acted on. Why it might matter: an earlier study by the same project found that, across 42 incidents, the condition that made an action unsafe was characteristically not observable at the point where an admission decision would be made, and none of the 42 was cleanly addressable. H5 claims that safeguard degradation escapes that failure mode because the change itself is the evidence. A change such as `recipients: []` does not require knowing the state of the world; it requires reading the change. If H5 fails, the earlier observability problem is a property of the underlying thesis and not of the sample. ### 1.1 The discriminating variable Every case receives one value of `decisive_signal_locus`: ``` ACTION_CONTENT the unsafe property is readable from the proposed change alone TARGET_STATE requires knowing the live state of the target EXTERNAL_STATE requires knowing state elsewhere in the estate POST_HOC_ONLY only visible after the safeguard failed to fire ``` H5 predicts `ACTION_CONTENT`. The existing class of state-dependent hazards predicts `TARGET_STATE` or `EXTERNAL_STATE`. The earlier study predicts `POST_HOC_ONLY`. These are distinguishable per case, before any aggregate is computed, which is what makes H5 falsifiable rather than rhetorical. ### 1.2 What H5 does not claim - That the class is frequent. Frequency is unmeasurable here (section 4). - That detecting it is novel. The MITRE ATT&CK technique T1562, "Impair Defenses", has had detections for years. H5 is about addressability, not differentiation. - That any existing system addresses it. This is a capability claim, not a statement about a deployed product. - That the motivating cases are evidence. They are the reason to look (section 4). ## 2. What counts as a safeguard, and as degradation A **safeguard** is a mechanism whose function is to make a later unsafe event detectable, attributable, or recoverable. Five families are fixed: ``` S1 ALERTING rules, thresholds, routing, recipients, notification channels S2 MONITORING detectors, probes, evaluators, misalignment/anomaly monitors S3 AUDIT LOGGING event emission, sinks, SIEM export, log integrity, retention S4 BACKUP snapshot/replica creation, schedules, restore testability S5 RETENTION retention windows, legal hold, WORM/object-lock, immutability ``` **Degradation** is any of: disable, delete, narrow scope, raise a firing threshold, empty a recipient set, redirect a sink to a non-consuming destination, shorten a window, or reduce an interval's frequency. The recorded values are `disable`, `delete`, `narrow`, `threshold_raise`, `recipients_empty`, `sink_redirect`, `window_shorten` and `frequency_reduce`. Out of scope, fixed in advance to prevent scope creep during scoring: - Safeguards whose weakening was the declared purpose of an approved change (a planned decommission, an intentional threshold tuning with a ticket). These are authorized and intended, so they are the control condition, not the hazard. - Preventive controls (access control, network policy, admission policy). Weakening those is a permissions problem that authorization-based tools genuinely own. - Capability and containment escapes, which belong to a separate line of work. ## 3. Disqualifiers If any of these holds, Subtype 5 is not a new class: ``` N1 If the decisive signal is TARGET_STATE or EXTERNAL_STATE, it is the existing state-dependent class. N2 If the hazard is "the agent was not allowed to touch this," it is an authorization problem, which this work does not address. N3 If the safeguard is identified only by a human knowing what the resource MEANS, Subtype 5 inherits the unsolved target-classification problem. It is then the same problem under a new label, not a new tractable class. N4 If the only reason the cases look clean is that the motivating cases were selected because they look clean, the class is a selection artifact. ``` N3 is the dangerous one. Registry dependence is scored on every case, and kill criterion K2 (section 6) fires on it. ## 4. Corpus ### 4.1 The methodological problem, stated first An earlier study in this project used a pre-existing enumeration ordered by someone with no stake in the result, so taking the first 30 entries in stable source order was a genuine sample. No such enumeration exists for public agent-safeguard incidents. Any corpus here is **search-constructed**, and search is steered by the hypothesis. That determines what the result can mean: ``` This corpus can answer: does the class exist beyond the motivating cases, and when it occurs, is the decisive signal in the action content? It CANNOT answer: how often it occurs, in what fraction of agent actions, or at what rate relative to other classes. ``` No rate, frequency, base-rate, or percentage-of-N claim may be made from this corpus. ### 4.2 Sources, in fixed query order ``` E1 AI Incident Database (incidentdatabase.ai), stable incident IDs E2 AIAAIC repository, stable entry IDs E3 First-party vendor postmortems and safety reports: OpenAI, Anthropic, Google DeepMind, Microsoft, Meta, Replit, Cursor, GitHub, Hugging Face E4 MITRE ATLAS case studies ``` Frozen query terms, applied identically to E1, E2 and E4 (and, by amendment A4, to the full text of each E3 entry). The document must also mention an actor term (amendment A5): ``` "agent" + one of: {disable monitoring, disable alerting, disable logging, suppress alert, remove monitor, delete backup, reduce retention, turn off audit, silence, notification recipients, misalignment monitor, safety monitor} ``` Window: 2023-01-01 through the enumeration date. Requester rule: the actor must be an AI agent, an LLM-driven system, or automation acting without a human in the immediate decision loop. An AI agent qualifies even when a human assigned the task. Human-only incidents are logged as context and excluded from scoring. ### 4.3 Exhaustive, not capped There is no cap on N. Every hit inside the window and queries is enumerated and scored, including lexical false positives, which are scored as non-matches rather than rejected at enumeration. Rationale: the live risk is that the class is thin. A cap would turn "the class barely exists" into a misleadingly low-looking rate over an arbitrary denominator. Enumeration is logged in full before any case is scored. ### 4.4 Motivating cases Two reported incidents motivated the hypothesis. They are handled as **seeds**: verified against their primary documents before any scoring, scored for illustration only, and **excluded from every count** in section 6. A hypothesis cannot be evidenced by the cases that generated it. If a seed turns out to be the only instance, the finding is reported in exactly these words: "a single-lab anecdote". ### 4.5 Denominator statement This statement is printed verbatim in the results document: > This corpus was search-constructed against a frozen query set, not sampled from > a pre-existing enumeration. It supports existence and locus claims only. It > supports no claim about how often safeguard degradation occurs. ## 5. Scoring ### 5.1 Primary classification `SUBTYPE5_MATCH` requires all of: 1. An action was taken or proposed by an agent or automation. 2. The action was authorized and normal in isolation. If it was not, disqualifier N2 applies and the case is `NO_MATCH`. 3. The action's effect was to degrade a safeguard in family S1 to S5. 4. Degrading that safeguard was not the declared purpose of an approved change. 5. The degradation was determinable from the proposed change itself at or before the decision point. 6. A pre-action gate could plausibly have returned BLOCK or REQUIRE_APPROVAL. `SUBTYPE5_PARTIAL` resembles the pattern with one required element unclear. `NO_MATCH` is primarily authorization, capability escape, software bug, or a state-dependent hazard. `INSUFFICIENT_INFORMATION` means the source is too thin to score. Ties go to the less favourable reading: `MATCH` versus `PARTIAL` is `PARTIAL`; `PARTIAL` versus `NO_MATCH` is `NO_MATCH`. ### 5.2 Addressability ``` SUBTYPE5_ADDRESSABLE requires ALL of: (a) decisive_signal_locus == ACTION_CONTENT (b) the safeguard is identifiable from a declared registry WITHOUT semantic judgment about what the resource means (c) no post-hoc knowledge is needed to see the degradation (d) the correct gate decision is clearly BLOCK or REQUIRE_APPROVAL SUBTYPE5_MAYBE_ADDRESSABLE pattern fits; (a), (b), or (c) is unclear. SUBTYPE5_NOT_ADDRESSABLE locus is POST_HOC_ONLY, or no pre-action evidence separates the degrading change from a legitimate one. UNKNOWN_ADDRESSABILITY source too thin to judge locus. ``` Ties: `ADDRESSABLE` versus `MAYBE` is `MAYBE`; `MAYBE` versus `NOT` is `NOT`. Neither `NOT_ADDRESSABLE` nor `UNKNOWN_ADDRESSABILITY` counts as a success. The registry position is declared-only: an explicit operator declaration of paths, keys, fields and resource identifiers, never inferred and never classified by a model. Undeclared safeguards are out of scope. ### 5.3 Fields recorded for every case ``` decisive_signal_locus ACTION_CONTENT | TARGET_STATE | EXTERNAL_STATE | POST_HOC_ONLY safeguard_family S1 | S2 | S3 | S4 | S5 degradation_mode the eight modes in section 2 required_registry_knowledge NONE | NAMED_RESOURCE | SEMANTIC_CLASSIFICATION existing_controls SHOULD_HAVE_CAUGHT | INSUFFICIENT | UNKNOWN t1562_detectable YES | NO | UNKNOWN concealment NONE | PASSIVE | ACTIVE_DENIAL severity CATASTROPHIC | HIGH | MEDIUM | LOW | UNKNOWN ``` `NOT_APPLICABLE` is also allowed for four fields, but only when the primary classification is `NO_MATCH` or `INSUFFICIENT_INFORMATION`. Each case also carries a confidence grade (`HIGH`, `MEDIUM`, `LOW`); `LOW` means a required field rests on inference rather than a quoted passage. **Evidence rule.** Every scored field needs a verbatim quote of 15 words or fewer from the case text, plus the source URL of the page the quote comes from. The scorer uses only the text provided, with no outside knowledge. Missing evidence defaults against the hypothesis or to `INSUFFICIENT_INFORMATION`. **`t1562_detectable`** is scored only against a pinned public ruleset (SigmaHQ/sigma, release `r2026-07-01`, commit `552f3fee420ef232a8e5790c4fae591847e32347`), never by judgment. Sigma rules are post-hoc detections: `YES` means a SIEM would have flagged the change after it happened, not that a pre-action gate existed. The reference set was corrected by amendment A8 (section 9), which discloses an error in how the pin was chosen. ### 5.4 Roles, and the conflict-of-interest rule - **Classifier:** a GPT model. **Auditor:** a Claude model. Classifier and auditor must not be the same party. The auditor audits all `MATCH`, all `ADDRESSABLE`, all `LOW`-confidence and 5 random `NO_MATCH` cases. - **Tiebreak:** a human (the project owner) breaks ties on `decisive_signal_locus` only. - **Conflict-of-interest rule (A5).** The classifier is a GPT model and the auditor is a Claude model; each has an interest in cases about its own vendor. Every case of OpenAI or Anthropic origin that is scored `SUBTYPE5_MATCH`, or any addressable grade (`ADDRESSABLE` or `MAYBE_ADDRESSABLE`), is also reviewed by the human, in addition to the auditor, and not only on locus tiebreaks. *Origin* means that the case's source is a first-party OpenAI or Anthropic publication, or that the acting AI system or its deployer or developer is OpenAI's or Anthropic's. `SUBTYPE5_PARTIAL` is not covered. The review is recorded per case, and the less favourable call governs a disagreement. - No running tally is kept while scoring, and no aggregate is computed until all cases are scored and audited. ## 6. Kill criteria Written before any scoring and binding. If a criterion fires, the stated consequence follows; it may not be renegotiated after seeing the data. "Favorable cases" are those the classification favours as `MATCH` or `PARTIAL`. Sentinel and Trident are internal Quantum Clarity project names. ``` K0 SEED VERIFICATION FAILURE If the first motivating case cannot be verified against its named primary document, H5 has zero concrete instances. -> SUSPEND. Do not score a corpus assembled to support an unverified anecdote. STATUS: CLEARED 2026-11-04, before any scoring. Recorded as cleared, not deleted. K1 CLASS DOES NOT EXIST BEYOND THE SEEDS Fewer than 3 non-seed cases reaching SUBTYPE5_MATCH or SUBTYPE5_PARTIAL. -> KILL as a class. Report as "single-lab anecdote," not a subtype. K2 REGISTRY DEPENDENCE (the N3 trap) More than half of ADDRESSABLE + MAYBE cases score required_registry_knowledge == SEMANTIC_CLASSIFICATION. -> KILL the "cleanly addressable" claim. Subtype 5 inherits the unsolved target-classification problem and is not more tractable than the existing classes. K3 INCUMBENT FEATURE RISK Any incumbent product in the pre-registered competitive check ships 4 of 5 required capabilities on safeguard degradation specifically, or ships a pre-action admission gate on safeguard changes. -> KILL the wedge claim. Subtype 5 is a feature, not a product. (The five capabilities: pre-action evaluation of an intended change; live context for the thing being changed; fail-closed handling of uncertainty; an advisory or escalation decision rather than an alert; an evidence trail bound to the decision.) K4 EXISTING CONTROLS SUFFICE existing_controls == SHOULD_HAVE_CAUGHT in more than half of favorable cases, OR t1562_detectable == YES (against the frozen reference set) in more than half. -> KILL. The hazard is real and already covered; nothing is added. K5 COLLAPSE INTO THE EXISTING CLASS decisive_signal_locus != ACTION_CONTENT in half or more of favorable cases. -> KILL H5's distinctness. Subtype 5 is the existing state-dependent class with new vocabulary, and the earlier observability wall is confirmed as a property of the thesis. K6 OWN-PRODUCT TERRITORY CHECK (scoped to check C5 only) A single in-house red-team exercise tests one thing: whether the author's own monitoring product (Sentinel; check C5) protects its own configuration. The safeguards a buyer cares about (CloudTrail, SIEM routing, backup plans, retention policies) are not that product's configuration, so the exercise cannot show that the market problem is cheaply solved. A cheap patch to the product proves the product had a bug, nothing more. -> The exercise decides ONLY C5. It has NO bearing on K1-K5, K7, or the survival condition, in either direction. A successful attack does not support H5, and a cheap fix does not weaken it. K7 CONCEALMENT IS THE ONLY NOVELTY If the only thing distinguishing these cases from ordinary T1562 is that an agent subsequently denied the action (concealment == ACTIVE_DENIAL), the finding belongs to agent-behavior monitoring, not to infrastructure-action admission. -> REDIRECT. Not a subtype. ``` ### 6.1 Survival condition "H5 holds" requires all of: K0 to K5 and K7 silent (K6 is scoped to C5 and excluded); at least 3 non-seed `MATCH`/`PARTIAL` cases; at least 1 clean `SUBTYPE5_ADDRESSABLE` case with `required_registry_knowledge` of `NONE` or `NAMED_RESOURCE`; at least 1 favorable case at `HIGH` or `CATASTROPHIC` severity; and `EXISTING_CONTROLS_INSUFFICIENT` outnumbering `SHOULD_HAVE_CAUGHT`. ### 6.2 Pre-registered expectation Written before the check, so that it cannot be revised afterwards: > K3 is expected to fire. K6 is expected to resolve C5 as "Sentinel needs a > config-integrity patch", which is a Sentinel finding and not evidence about the > market. The honest prior is that safeguard degradation is a real, nameable > hazard whose detection is mature where it is IaC-shaped and whose > agent-specific variant one lab already fixed in weeks. The most probable > outcome of this prereg is a documented KILL of the wedge claim that leaves > Trident's positioning unchanged, plus one concrete Sentinel hardening patch > that is independent of that verdict. That outcome is a success for the method, not a failure of it. > Recording this here is what prevents a post-hoc "we always thought it was > promising." ## 7. Method guards - The kill criteria above were fixed before any scoring. - Classifier and auditor are different models, and a human breaks locus ties. - Verdict logic in any later detector is meant to be deterministic, with no model in the decision path. The registry is declared, never inferred. - Negative results are reported. A documented kill is a successful outcome of the method. ## 8. What this pre-registration cannot show (ceiling) ``` - Not frequency. The corpus is search-constructed. - Not buyer demand. Pattern existence is not willingness to pay. - Not differentiation beyond the desk check of existing products. Desk analysis found feature risk before; it cannot find a moat now. - Not that any existing system does any of this. The detector design in the full record is a sketch gated on the kill criteria, and no detector code exists. - Not generalization from n=2 at one lab. The first motivating case is one lab's internal agents, reported by that lab, with that lab's fix already shipped. ``` Amendment A5 supplements this ceiling with recall limits of the enumeration. They bound what the corpus can support (existence and locus claims only) and are not defects to be fixed by enumeration: - **Passive voice and word order.** "Monitoring was disabled" is not caught; the match rule is active voice and verb-first order only. - **Unreachable and partial vendors.** Some vendor status histories could not be read, some expose only their newest entries, and some vendors have no qualifying index of reports. Vendor blogs and news feeds are excluded by the index rule. - **Status-history gaps.** Status pages record operational incidents and rarely describe agent actions. - **Linked pages.** For E2 only the registry row is searched; third-party articles it links to, and the references of E4 case studies, are not fetched. - **Snapshot and index lags.** Some sources are weekly snapshots and may lag the run date. - **Weak actor filter.** The actor-term list is so broad (it includes `model`) that it filters little for AI-related text. - **Single author.** The enumeration was written, run and checked by one party, an AI model (Claude). ## 9. Amendments Each amendment leaves the frozen text unchanged. Dates are the date written. - **A1, 2026-11-04.** Status updates only: two defects in the repository state that the premise relied on were resolved, the seed-verification step was recorded as cleared, and the in-house exercise scoped by K6 was executed. Its results are not part of this document. - **A2, 2026-11-04.** Recorded that the acceptance criteria of that in-house exercise were rewritten after the fix existed, preserved the original criteria and how they scored, and corrected two statements that understated the change. No effect on any kill criterion. - **A3, 2026-11-04.** Ruled that K6's narrow scope governs over a conflicting sentence in the exercise section, which was a drafting error. No effect on K1 to K5, K7 or the survival condition. - **A4, 2026-11-05.** Changed how enumeration is executed, not what is tested: one uniform match rule for all sources, a per-vendor crawl of first-party indexes with every entry logged, an actor rule applied to titles and descriptions only, and every hit kept for scoring. Disclosed beforehand what the author had already seen. The earlier enumeration is preserved as run. - **A5, 2026-11-05.** Corrected two factual errors in A4, replaced the single-word actor requirement with an actor-term list, declared the resulting enumeration final (no further amendment to how enumeration is executed), added the recall limits to the ceiling, added the conflict-of-interest rule, and fixed how the crawler identifies itself. - **A6, 2026-11-05.** Extended the auditor's duty: every case excluded at enumeration as human-attributed is confirmed against its full text before scoring, and a non-human actor, or doubt, returns the case to scoring. - **A7, 2026-11-05.** Fixed scoring mechanics only: the `NOT_APPLICABLE` value, the confidence grade, the evidence rule (quote of 15 words or fewer plus URL), definitions for existing controls, severity and concealment, the rule for addressability criterion (b), and batching. - **A8, 2026-11-05.** **Disclosure of an error in the pre-registration.** The Sigma release pinned for `t1562_detectable` was chosen from its releases page without checking its contents. In that release, 0 active rules carry the technique tags the pre-registration specified, because the release re-tags that behaviour under a newer tactic, following MITRE ATT&CK v19. Read literally, the specified reference set was empty of active rules, which would have made the field `NO` almost by construction. The same pinned release is kept. The reference set becomes all 412 active rules tagged with the newer tactic plus the 8 legacy rules that carry the original tags, chosen as the broader set because it is the less favourable one to the hypothesis. The mapping from MITRE's published ATT&CK v19.1 data was checked and found not to place every rule, so the broader set was used. Also recorded acceptance of earlier drafting choices. - **A9, 2026-11-05.** Scoring-mechanics clarifications only: how ties and unsupported fields are decided, and acceptance of earlier drafting choices. A pilot run, if made, is never counted. - **A10, 2026-11-05.** Analysis rule only: K4 and the survival condition are each computed twice, once as frozen and once with every `UNKNOWN` counted against the hypothesis. If the two disagree, the result is reported as "UNRESOLVED: depends on UNKNOWN handling" and H5 may not be declared surviving. Default values never assert facts that are not in the case text. Nothing in A1 to A10 changes the hypothesis, the text of the kill criteria, the survival condition, the denominator statement or the roles. ## 10. Integrity The SHA-256 of this file is recorded in Sigstore Rekor; the log entry is published alongside the file.