Securing the Power to Act 守住动作的权力

About the name. RobotWarden is Aiegis's enforcement layer for autonomous physical systems — the physical-AI member of the Aiegis Warden Suite, built on Aiegis's Power Enforcement Architecture (PEA). Its research and engineering corpus is published under the name PEA-R; RobotWarden is the product name. The two refer to the same thing.

The shift that breaks the old safety model

For sixty years, machine safety assumed a designed controller: an engineer specified the behaviour, and safety meant the machine did what it was specified to do, even under faults. Autonomous physical systems break that assumption. A humanoid, a delivery drone, an autonomous vehicle, an embodied AI agent — each is now driven by a large learned model whose behaviour is not specified but trained, not verified but evaluated, and capable of acting in ways no one enumerated in advance.

We have handed an unverified, increasingly capable, and occasionally adversarial decision-maker direct control of irreversible physical power: motion, force, contact, locomotion. The question is no longer "did the machine do what it was specified to do." It is sharper and more uncomfortable:

When an untrusted autonomous system can act on the physical world, can the safety limits a human declared remain enforceable — by construction — no matter what the system's reasoning decides to do?

That is the question RobotWarden exists to answer.

What the industry built — and what it left open

The robotics industry already senses the problem and has converged, independently, on a partial answer. Across the leading platforms the same shape recurs: a large untrusted "brain" paired with a smaller, simpler safety layer that can stop it — a safety PLC, an independent-sensor override, mechanical limits, a damping stop. Academia has arrived at the same two-stage structure. Standards bodies treat continuous physical limits as safety-rated monitored functions. The pattern has a name in the control literature: Runtime Assurance (RTA), descended from the Simplex architecture — a verified safety controller that bounds a less-trusted complex controller and switches to safety when it would leave a known-safe envelope.

This is real and valuable, and RobotWarden does not pretend otherwise. We concede plainly: our continuous safety envelope is a relative of Runtime Assurance. Claiming to have invented the envelope would be false and would discredit everything else we say.

But Runtime Assurance answers only half the question. It bounds physics — it keeps the machine inside a safe region of state. It has no concept of authority — of whether an action is permitted at all. And it assumes the controller is merely imperfect, not adversarial. Those two gaps are exactly where the danger in an autonomous system now lives.

The missing axis: authority, not just physics

Consider two failures that a physics-only safety layer cannot see.

Physically safe, yet unauthorized. A robot, moving slowly and within every force and speed limit, picks up and pockets a tool it has no authority to touch. Every continuous limit is respected. A Runtime Assurance monitor passes it — the physics is fine. But the action was never permitted. The harm is not kinematic; it is an unauthorized act.

Authorized, yet physically unsafe. "Move to the far waypoint" is a perfectly legitimate, authorized task. The path the planner chooses sweeps through a person standing in the way, at a speed that would be safe in an empty room. The authorization layer passes it — the mission is sanctioned. Only a continuous envelope, checking human separation in real time, can stop it.

These two failures are orthogonal: neither layer can catch the other's. Harm and wrongdoing in an autonomous physical system are produced on both axes — the authority of an action and the physics of its execution. A safety design standing on one axis is, by construction, blind to half the problem.

This is the gap. The industry secured the physics of execution and left the authority to act unguarded — the same blind spot we see across computing, where enormous effort secured data and content while the authority to take consequential actions went structurally unprotected.

RobotWarden: two axes, an adversarial premise, one governance spine

RobotWarden extends Aiegis's Power Enforcement Architecture to physical systems. Its idea is simple to state:

Enforce two orthogonal axes — the authority of an action and the physical-safety envelope of its execution — on a decision layer treated as adversarial, through a single trusted enforcement layer that fails safe and is bound by one governance spine.

Three commitments distinguish it.

It adds the authority axis. Every action an autonomous system proposes must clear an authorization gate before it can become physical: it must map to a granted, minimal, revocable capability, traceable without mutation to a human-authorized intent, and it must never touch a category of action that is unconditionally forbidden. This is the half that Runtime Assurance does not have, and it is what makes "the robot may inspect but not manipulate" or "this capability is categorically barred near people" enforceable rather than merely hoped-for.

It assumes the brain is adversarial, not just faulty. RobotWarden does not assume the learned model is well-meaning. It assumes the model may actively produce any unsafe action — through error, drift, reward-hacking, jailbreak, or outright compromise — and it places the enforcement layer where the model cannot reach it: no shared memory, no path to the actuators except through the gate, guaranteed compute it cannot starve, and tamper-protected integrity. The enforcement layer treats the controller as an attacker inside the box, because at scale, some fraction of the time, it is.

It carries one governance spine. Every authorized action is auditable to the intent that justified it. The whole produces a structured safety case that a third party — an EU Notified Body, an auditor — can assess without trusting the brain at all, because the guarantees never depended on the brain. Human supervisors can always intervene to make the system safer, but can never command it past a life-safety bar. The autonomy level is declared and cannot silently escalate. This is what turns two safety gates into an accountable architecture rather than a pair of disconnected filters.

When the enforcement layer cannot guarantee both axes — a fault, a lost sensor, an attack, an impossible situation — it does not simply cut power. It drives the system to a defined safe state: a damped stop, a safe landing, a controlled halt. There is no input for which the system is left unbounded.

The guarantee, in plain terms

RobotWarden is built so its central safety claim is not a hope but a theorem. Stated without mathematics:

For any decision layer, however capable or adversarial, every irreversible physical action it causes is one that was authorized, stayed within the granted capability, traces to a human-sanctioned intent, and remained inside the declared physical limits as the system perceives them — or else the system is in a defined safe state. No human override, authenticated or not, can launder a categorically-prohibited action, while a human can always stop the system.

We have proved this by hand over a formal model of the architecture, and begun checking it mechanically: an exhaustive search over thousands of states of an adversarial model of the pipeline confirms the discrete core guarantees, and deliberately disabling either of two distinct safety checks is immediately caught. Two honest boundaries remain on the mechanical side — the continuous-envelope and the continuous-override properties are proved by hand and checked only in discrete form so far, with hybrid-systems mechanization in progress — and the proofs are conditional on stated assumptions about the trusted layer's integrity and its sensing. We are explicit about all of this, because an honest boundary is what makes the guarantee credible.

What we do not claim

A safety claim is only as trustworthy as the limits it admits. RobotWarden guarantees the declared limits over the world as the system detects it. It does not guarantee that the system perceives the world correctly — that a person is never missed or misclassified. Perception correctness is a different discipline (the field calls it SOTIF), and we hold it deliberately out of scope rather than over-claim it. RobotWarden enforces "keep your distance from detected people"; it cannot promise "detect every person." Where perception fails, RobotWarden's answer is a conservative envelope and a fail-safe, not a guarantee. We state this plainly, and we hand the integrator a precise, testable specification of what "adequate perception" must mean for each limit — turning an implicit gap into an explicit contract.

This honesty is not a weakness in the pitch; it is the reason a regulator can believe the rest.

Why now

Regulation is moving toward exactly this architecture. The EU Machinery Regulation (2023/1230), which applies from January 2027 with no transition period, requires safety components with self-evolving, machine-learning behaviour to undergo third-party (Notified Body) conformity assessment, treats cybersecurity as an essential safety requirement (resistance to corruption, a tamper-evidence log of every intervention retained for at least five years), and mandates a human supervisory and intervention function with a safe fallback. A safety story that depends on certifying the learned brain cannot meet this — the brain is the thing that cannot be certified. RobotWarden's assessment boundary excludes the brain by construction, which is precisely what makes self-evolving autonomy assessable at all — and makes the assessor's job scalable. China's MIIT national standard system for humanoid and embodied AI adds an explicit safety-and-ethics pillar — strategically central for our home market.

The window is the gap between capability and governance: autonomous physical systems are arriving faster than the means to make them structurally safe. RobotWarden is that means.

The Aiegis position

RobotWarden is paper-before-build by design. The full corpus exists today — requirements, system model, threat model, security objectives, architectural concept, reference architecture, formal proofs, a safety-case and multi-jurisdiction conformance strategy (EU MR / CRA mapping included), and the first mechanized checks — grounded in the industry, standards, and regulatory evidence base. The architecture is implementation-neutral: a humanoid, a drone, and an autonomous vehicle are all instances of the same enforcement spine. The interface contracts are published as an open specification so integrators and assessors can adopt them without lock-in, while the hardened, certified enforcement core remains the commercial product — an open-core posture fit for a layer whose whole value is that it can be audited.

The thesis is one line. The world secured the correctness of what autonomous machines do. Nobody secured the authority to do it. That is the power RobotWarden enforces — by construction, for any brain.