AI agents are starting to control physical machines. An agent can be wrong: its sensors can be spoofed, its model can drift, or a hostile instruction can be slipped into its prompt. If its output goes straight to the motors, a wrong decision becomes a physical event.
Agentic CPL puts a separate checkpoint between the agent and the machine. The agent only proposes. The checkpoint verifies who sent a command, that it is fresh, and that it is within fixed limits. Safe commands are signed; unsafe ones are blocked and the machine holds position. Actuators execute signed commands only.
Both drones receive the same commands from the same agent. Left: no trust layer. Right: with Agentic CPL. Dashed square: the allowed area. Red zone: a restricted area. The log and counters show every decision.
Press Run guided scenario for a hands-free walkthrough with captions (about 100 seconds). Or press Start, then Inject fault, Inject forged command, Replay last command, and switch the network to Offline.
This is the target architecture for production. In this demo both keys are generated with WebCrypto (extractable: false, so the page cannot export them) and live in the browser page; the isolation drawn above is the production design, not something the browser provides. The agent key protects the channel from forged or replayed input; it does not make a compromised agent trustworthy, which is why the bounds check still runs on every authenticated command.
Stage 3 of the TRUST-ANCHOR specification (hardware root of trust, firmware attestation) is shown as the target architecture only. This simulation does not implement a TPM or attestation.