Containment
Where the boundary applies
SafeSystem, SafeEcosystem, SafeSovereignty, and SafeCivilization define distinct containment scopes.
Five protocol enforcement layers
Govern How AI Execution Moves Across Time, Systems, and Boundaries
SafeWave Protocol Enforcement defines the machine-speed rules governing active runtime behavior, escalation pathways, replication, execution-path selection, and participation or re-entry across advanced AI systems.
Containment defines the boundary. Enforcement substrates provide specific controls. Protocols govern how execution proceeds and interacts across those boundaries.
Runtime interaction
Escalation containment
Replication control
Execution-path governance
Participation and re-entry
Protocols
How execution proceeds
The five protocols govern active runtime behavior, escalation, replication, pathway selection, and participation or re-entry.
Substrates
What specific controls enforce
Core Enforcement Substrates provide the problem-specific control mechanisms used within the relevant system boundary.
1. Why protocol enforcement exists
Local safeguards are not enough when execution crosses systems and operating states
Advanced AI increasingly operates through agents, tools, distributed services, shared infrastructure, persistent workflows, model and provider choices, recovery behavior, and connected devices. Execution can move across boundaries faster than centralized review or human intervention can reliably govern.
Protocol enforcement addresses this movement. It supplies distinct rules for how execution remains bounded while active, how escalation is constrained, how replication and propagation remain bounded, how an execution pathway is selected and limited, and when a node may participate or re-enter under unstable operating conditions.
The protocol layer is not a generic coordination layer. Each protocol closes a different failure surface and remains distinct from the containment layers above it and the enforcement substrates below it.
2. The five protocols
Five separate boundaries—not one generalized runtime mechanism
Protocol 1
SafeRuntime
Governs active runtime interaction and execution behavior as systems operate across connected environments.
How must execution behave while it is actively running?Protocol 2
SafeEscalation
Governs escalation-path containment so machine-speed interactions cannot expand authority, reach, or instability without defined limits.
How are escalation pathways constrained as conditions intensify?Protocol 3
SafeReplication
Governs bounded replication and propagation behavior across distributed systems and connected environments.
What may be copied, propagated, reproduced, or extended—and under what limits?Protocol 4
SafePathway
Selects among approved models, providers, tools, hosting environments, and execution paths under supplied constraints, while bounding pathway expansion.
Which approved execution path satisfies the task and constraints, and how may that path expand?Protocol 5
SafeAdmission
Governs node-resident participation, reconnection, retry, and re-entry under instability without depending on semantic interpretation.
When may a node participate or re-enter under unstable operating conditions?3. Why the protocols remain separate
Execution movement creates several different failure surfaces
Combining them creates ambiguity
A single generalized protocol would blur runtime behavior, escalation, propagation, pathway selection, and re-entry into one mechanism, making failure states harder to identify and guarantees harder to test.
Separating them creates testable boundaries
Each protocol can define its own states, gates, transitions, evidence, degraded behavior, fail-closed conditions, and recovery requirements while still composing with the others.
No protocol replaces another. SafePathway does not perform SafeAdmission. SafeAdmission does not select models or tools. SafeReplication does not govern all runtime behavior. SafeEscalation does not replace the control mechanisms used to enforce specific limits.
4. How the architecture composes
Containment scope, protocol behavior, and enforcement mechanisms work together
1
Containment scope
The relevant System Containment Layer defines where accountability and bounded operation apply.
2
Protocol state
The relevant protocol determines how execution may proceed, interact, escalate, propagate, select a pathway, or permit node participation or re-entry under instability.
3
Specific enforcement
Risk-matched Core Enforcement Substrates apply the necessary authority, scope, compute, telemetry, provenance, device, hardware, or other controls.
4
Evidence and recovery
The combined implementation preserves evidence of protocol state and enforcement outcomes, then requires defined conditions before limits are widened or normal operation resumes.
A deployment does not automatically require all five protocols or all 25 Core Enforcement Substrates. The necessary combination depends on the system’s authority, autonomy, coupling, operating conditions, and consequences of failure.
5. Where protocol enforcement matters
Machine-speed interaction increases the value of explicit protocol boundaries
Distributed and agentic systems
Multi-agent coordination, delegated work, tools, background processes, model changes, provider selection, replication, retries, and external actions create several independent execution pathways.
Infrastructure and embodied systems
Cloud orchestration, edge nodes, robotics, fleets, critical infrastructure, and degraded-device operation require deterministic rules for participation, escalation, propagation, and recovery.
The protocol-enforcement principle
Execution should not gain reach merely because systems can interact faster than people can supervise them.
Use the protocol layer to identify where execution can escape its intended boundary
The SafeWave questionnaire can be completed privately in the browser using a real, planned, anonymized, hypothetical, public, or composite system. A submitted questionnaire can produce a private, system-specific report identifying which protocol boundaries and enforcement mechanisms appear relevant without assuming that the entire architecture must be deployed. The report is available at no cost and with no obligation.