A compromised server cannot invent orders

The usual arrangement puts everything in one place.

A central brain decides what should happen and then tells the machines to do it. It is simple, and it means the brain is the whole security boundary. Anything that reaches it can make a robot do anything the robot can do.

Splitting it by cost rather than by convention.

Deciding what to do is expensive. It needs the model, the corpus and the context, and it belongs on the server. Deciding whether an action is permitted is a table lookup, and a small unit can afford to do that for itself.

So the server resolves a destination and forwards a proposal, and the destination's own gate decides. The failure mode changes shape completely. A compromised server can drop an instruction, delay it, or send it somewhere wrong. It cannot manufacture one.

Telling one machine to instruct another is a separate, harder thing.

It needs a grant that was signed in a physical-presence ceremony and that names the destination, the action, the arguments and an expiry. The destination verifies that signature itself. It never takes the server's word that a grant existed.

Units cannot address each other directly at all. Everything crosses at the server, where it can be mediated.

Offline is structural here too.

The main model has no network namespace, so there is no setting to get wrong. The lowest access tier is walled off rather than filtered: ambient facts and a public corpus only, with no vault, no world model, no sensors, no history and no network. Not a filtered view of the real thing, a genuinely different and much smaller thing.

Stored routines follow the same rule. A routine composes tools that already exist and never becomes a new capability. It runs as the invoker, capped at the author's authority, and every step is authorized individually.