The Seven Invariants

Foundational contracts for Sector8 evaluate-before-dispatch on routed integrations.

The seven invariants are the foundational contracts of the Sector8 gate. When your runtime routes proposed actions through Sector8, these properties define how evaluation and dispatch control should behave.

Violation on a routed path is a critical defect. Coverage still depends on the integration: unconnected tools and bypassed dispatch paths are not automatically covered.

The full invariants reference with implementation details is covered in the Guardrails guide.

#	Name	Contract
INV-1	Single Execution Gate	No authorized routed path from model output to tool execution that skips evaluation. The admission path is the dispatch control point.
INV-2	Dual Gate Requirement	Policy decides intent. Authorization decides capability. Execution requires both.
INV-3	Per-Step Enforcement	Evaluation runs per tool call, per agent step, after planning and before execution.
INV-4	Untrusted Executor	The LLM produces candidates. The control plane decides outcomes.
INV-5	Spotlighting Before Policy	Content is trust-tagged before evaluation. Untrusted content cannot self-promote.
INV-6	Explicit Execution Condition	Execute only on an explicit ALLOW that your runtime honors. DENY, missing, or unknown decisions must not execute. On the MCP connector path, an unresolved human hold must not execute.
INV-7	Trust Inversion Forbidden	No component consuming untrusted outputs may be the final authority to permit execution.

Runtime semantics

Honor the decision before dispatch on the routed path:

Result	Runtime behavior
ALLOW	May execute the proposed action
DENY	Must block the proposed action
Missing / unknown / error	Fail closed; do not execute

On the MCP connector path, a borderline action can be held for a human before ALLOW or DENY is returned. Do not execute while that hold is unresolved. TTL expiry is a deny. REST evaluate does not wait.

Fail-closed applies when the action is routed through Sector8 and evaluation is unavailable or invalid. It does not stop actions on bypassed or unconfigured tool paths.

Sector8 returns the verdict. Your application owns enforcing it at the dispatch boundary.

See Evaluate, Guardrails, and API Overview.