TFB DAVID · Immune system
Every other instrument in this gallery gives a model bounded room to help. DAVID is the one that stands between the model and the actions it cannot take back. It is the immune system for agentic trust — the layer that decides whether an intelligent-but-fallible agent is allowed to spend, isolate, send, or delete.
Models keep getting smarter. The room they are handed keeps getting more dangerous.
AI agents are being handed real authority — tools, money, infrastructure, the ability to act without a person in the loop. The industry has poured its effort into making the model more capable. Almost no one has built the layer that asks a different question: before this action fires, has the intelligence behind it earned the right to fire it? DAVID is that layer. It does not try to make the model never wrong. It makes the model unable to turn a confident mistake into an irreversible one.
Six bounded checks between an agent and an action. Each is built; each is described here by what it guarantees, not how it is wired.
An approval is welded to the exact action it approved. Change a single parameter after the fact and the approval goes void — there is no "approved in spirit."
Guards: the swapped-argument attack, where an approved harmless call quietly becomes a harmful one.
An agent acts only inside a mission a human signed: what it may touch, what it may claim, when it expires. No mission, no capture. A tampered mission does not pass.
Guards: scope creep — an agent quietly widening its own reach.
Every consequential action lands in a hash-chained receipt ledger. You can prove what happened — and prove that nothing was rewritten after the fact.
Guards: the quiet edit to history that hides what an agent actually did.
An agent reaches only the tools its role has earned. Authority is granted, never assumed; anything unmapped is denied rather than waved through.
Guards: the over-privileged agent reaching a tool it was never meant to hold.
What the system believes is ingested on purpose, bound to its exact claim, traceable to every decision it touched, and revocable with its full blast radius. A forged approval and an anonymous operator are both made impossible.
Guards: the slow poisoning of an agent's memory until it acts on a planted belief.
DAVID learns each agent's healthy baseline and reads the slide toward failure — the early warning that precedes a bad action, captured as evidence, never as a guess.
Guards: the agent that degrades gradually until it is already doing harm.
An immune system that attacks healthy cells is worse than none.
DAVID runs live in observe mode, recording what it would have stopped — without stopping anything yet.
Those recordings are reviewed against real work. Enforcement is armed only when the evidence shows it will not fire on honest work.
Each check is armed deliberately, by a human, never blind — and every arming is reversible.
The newest theft is not your data. It is your model.
You spent the money to train it. A competitor does not need your weights — they can question your model at scale and distill its judgment into a cheaper clone. By the time it shows up as a rival, the moat is already drained.
Drawbridge is DAVID's watch for that pattern: the signature of a model being learned from, not merely used. It tells the difference between a heavy honest user and an extraction campaign before the campaign succeeds.