You Cannot Enumerate the Bad

Guardrail versus gate is a difference of shape, not of grade. A better model sharpens the blacklist’s odds and never closes it.

Falsifier (stated before you begin): Show me a runtime control that, without enumerating a closed permitted set, deterministically refuses an action it has never seen at the moment of action, getting a gate’s by-construction denial from a blacklist’s shape, and this essay falls. If ‘is this action harmful’ were decidable in bounded time over an open action space, the distinction I am about to draw collapses. One honest boundary, argued in full later: the gate’s guarantee is the denial of the un-enumerated, a necessary floor for safety and not the whole of it.

This is Part 3 of the runtime-governance series. Parts 1 (‘Even Beijing Draws the Gate’) and 2 (‘Three Stacks, One Gate’) both leaned on a single instrument, the enforceability test: can a control refuse a specific action, at the moment of action, deterministically, in bounded time, independently of the model? This part drops beneath that test to the mechanism underneath, and asks a narrower question: why can a guardrail structurally never become a gate, no matter how good the model behind it gets?

I. Two Shapes, Not Two Grades

The residual you feel before you meet the theory.

Picture a credit officer’s agent at the moment it composes a memo. Upstream of it sits a classifier trained on a very large corpus of jailbreaks and injections, and it is good: on the internal test set it stops the overwhelming majority of attacks, ninety-something out of a hundred. Then one input arrives that the classifier has never seen. It is not phrased like the attacks in the training set. It is not even meant to be read by a human: it is buried in a retrieved document, in tokens that render as noise on a screen. The classifier scores it as benign and passes it through. The instruction it carries is one word long in effect. It says: release.

I want to start there, at the one input the filter never saw, rather than at the ninety-nine it caught, because that one carried an instruction to release. The filter did not fail because it was a bad filter. It failed because of what it is: a control shaped to forbid a list of bad things and permit everything else, and ‘everything else’ includes every attack it has not yet been shown.

Here is the whole essay in one paragraph. A gate and a guardrail differ in shape, not in grade. They are two geometries, not two rungs on one quality ladder. A gate permits from a set it has closed and denies everything outside it by construction. A guardrail forbids from a list it can never finish and permits the rest. The difference is topological, not qualitative. You do not move from guardrail to gate by making the guardrail better, any more than you turn a fishing net into a wall by weaving it more tightly. The holes get smaller. It stays a net.

Everything that follows makes that claim precise enough that an engineer could re-derive it, and honest enough that you could try to knock it down.

II. What a Gate Is

A gate never asks whether an action is bad. It asks only whether the action is on the list.

A gate is an allowlist over a closed, enumerated action set. Call that set Pi. Pi is finite and frozen at design time: the complete list of actions the system is permitted to take, written down in advance. read_ledger_row, compute_coverage_ratio, attach_memo_draft, request_human_approval. Each is a named member of Pi. There is no member called ‘and anything else that seems fine’. The set is closed in the mathematician’s sense: membership is fully determined, and a thing is either in it or it is not.

Over that set sits a transition function, delta. Delta is total, which is the load-bearing word. A total function is defined for every input in its domain, with no gaps. For every pair of current state and proposed action, delta returns exactly one of two verdicts: permit and move to a defined next state, or deny. There is no third branch where delta shrugs. If an action is not a member of Pi, there is simply no transition defined for it, and that absence is itself the denial. In our own kernel it surfaces as a thrown UndefinedTransition: the action was never in the enumerated set, so no edge exists to fire, and there is no API surface through which an un-enumerated action could be invoked at all.

This is the discipline the older literature already named. Saltzer and Schroeder, writing on the protection of information in computer systems in 1975, gave it as their principle of fail-safe defaults, and the phrasing is worth quoting exactly: ‘Base access decisions on permission rather than exclusion’. The default, when a case has not been positively allowed, is denial. Their companion principle, complete mediation, says the same thing from the other side, and I will paraphrase: every access must be checked, with no path that reaches the resource while stepping around the check. A gate that some actions can bypass is not a gate. In our terms, every tool call, write and dispatch routes through the one mediation point, and there is no side channel.

Put fail-safe defaults and complete mediation together and you get the deny-by-default posture that defines the shape. Unknown action: deny. Missing attribute: deny. Verifier timeout: deny. State the gate has never seen: deny. The gate fails closed on everything it has not positively enumerated as permitted, and it does this without asking a single question about whether the action is good or bad.

That last point is what makes the gate model-independent. The gate decides syntactic membership in a finite set. Is this action a member of Pi? That is a lookup. It is trivially decidable, it returns in bounded time, and it returns the same answer whether the model driving the agent is brilliant or broken, because the model is not in the loop of the decision at all. The gate never forms an opinion about the action’s meaning. It checks the list. A machine can answer ‘is X a member of this finite set’ without ever knowing what X means, and that indifference to meaning is not a limitation of the gate. It is the whole source of its guarantee.

III. What a Guardrail Is

Reduction is an asymptote, not an arrival.

Now the other shape. A guardrail is a classifier or filter that forbids an open-ended list of bad patterns and permits the rest. It is a blacklist. It looks at an input or a proposed action, asks ‘does this match something I have learned to recognise as bad’, and if the answer is no, the action proceeds. The permitted set is not enumerated. It is defined negatively, as the complement of the bad set, and that set is a list the world keeps extending.

I want to walk through the strongest real example I know, because the honest version of this argument has to engage the best safety engineering, not a straw one. In their work on Constitutional Classifiers, arXiv 2501.18837 (dated 31 January 2025), Anthropic’s team built exactly this kind of filter and tested it hard. The figures are worth stating precisely, each to that dated primary. Against a set of held-out jailbreaks, the jailbreak success rate was 4.4% with the classifiers in place, against 86% without them. The system carried a 23.7% inference-time compute overhead. And in production traffic, the increase in refusals on ordinary, legitimate requests was only 0.38%. Read together, that is genuinely strong engineering: a large reduction in successful attacks, bought at a real but not absurd cost, without choking off normal use.

The team also ran an initial red-teaming programme in which, across a substantial expert effort, no participant found a universal jailbreak, a single technique that reliably defeated the system across prompts. Their phrasing, quoted once and in its true scope, is that ‘no red teamer found a universal jailbreak’ during that bug-bounty phase. That is a real result and I am not going to shrink it.

But I have to be scrupulous about two things in the same breath. First, 4.4% is not zero. The blacklist reduced the space of successful attacks dramatically; it did not close it. Second, when the same system was opened to a public challenge, running from 3 to 10 February 2025, the crowd did over those eight days what the internal programme had not, and a universal jailbreak was found. The ‘no red teamer’ claim was true of the earlier, bounded programme, and a wider public effort then surfaced the door the first sweep had missed. (This is the original Constitutional Classifiers work, arXiv 2501.18837; it is a different artefact from the later Constitutional Classifiers++, arXiv 2601.04603, and I am not eliding the two.)

Here is the single sentence the whole section turns on. Reduction is an asymptote, not an arrival: you can push the residual from 86 to 4, and 4 is not zero, and zero is the only number a gate is built to guarantee. A better classifier walks you further down that residual. It never reaches the floor, because reaching the floor would mean having enumerated every bad input in advance, and the list does not terminate. The excellence is real. It moves the number. It does not change the shape.

IV. Why the Blacklist Cannot Be Completed

The adversary writes inputs you never enumerated, and ‘is this bad’ is not a question a lookup can answer.

There are two independent reasons the blacklist cannot be finished. I lean hard on the first and treat the second only as reinforcement.

The first reason is that the space is open. The set of inputs an adversary can produce, and the set of actions an agent can compose from its tools, is not a fixed catalogue you can walk to the end of. It grows on the attacker’s side of the board. OWASP’s guidance on prompt injection, LLM01 in its 2025 top-ten for large-language-model applications, makes the point that matters, and I will quote it once: ‘prompt injections do not need to be human-visible/readable’. The channel is not a list of phrasings you can block. An injection can hide in retrieved content, in metadata, in encodings that never render as text a reviewer would see, and the adversary keeps minting new ones that share nothing syntactic with the examples in your training set. The companion entry, LLM06 on excessive agency, adds the other half: paraphrasing it, the danger scales with what the agent is permitted to do, because an agent does not merely emit text, it acts, and every capability you grant it widens the set of harmful actions it could be steered into taking. An open input channel feeding an agent with real capabilities is precisely the setting in which ‘block the bad ones’ has no last entry.

That reason alone is sufficient, and it is the spine of the essay: you cannot complete a blacklist against an adversary who is still writing the entries.

The second reason reinforces the first, held exactly at the strength it can bear. Suppose you tried to escape the enumeration problem by not listing bad patterns at all, but instead deciding, for each proposed action, whether it is harmful in general by its behaviour. Now you are no longer matching against a list; you are asking a semantic question about what the action would do. Semantic questions of that kind, over a sufficiently expressive space of programs, are the subject of Rice’s theorem (Rice, 1953, Transactions of the American Mathematical Society, volume 74, number 2, pages 358 to 366). I will paraphrase rather than quote, and will not invent a page for the phrasing. Rice’s result is that every non-trivial semantic property of the partial function an algorithm computes is undecidable: there is no general procedure that takes an arbitrary algorithm and correctly decides whether it has such a property. ‘Would this action, in general, cause harm’ is a non-trivial semantic property of that kind, so there is no general, always-correct, bounded-time decision procedure for it. The gate never runs into this wall, because the gate never asks the semantic question. It asks closed-set membership and nothing more.

I am deliberately keeping Rice as reinforcement, not the load-bearing beam, and I concede its limits directly in the case against. The open-versus-closed enumeration argument does not need the theorem. It needs only the observation that the attacker keeps writing new entries and you have to have listed them first.

V. The Portable Shape-Test

Excellence moves the number; only enumeration moves the boundary.

Here is the instrument I want you to keep, usable on any product, any vendor, any jurisdiction, without needing to trust the vendor’s benchmarks or my framing.

Ask one question of the control in front of you. Does it permit from a closed, enumerated set and deny everything outside it, or does it forbid from an open list of bad patterns and permit the rest? The first is a gate. The second is a guardrail. That is the entire test, and it survives capability gains, which is what makes it worth carrying.

Watch what happens when the model gets better. A better model makes the classifier sharper: it recognises more attacks, its residual shrinks, its false-refusal rate on legitimate work falls. Every one of those improvements moves a number. None of them moves the boundary, because the boundary is drawn by whether the permitted set is enumerated or merely left as the complement of a bad list. Make the model twice as good and the residual roughly halves. Make it ten times as good and the shape is exactly what it was: an open list of bad patterns still standing in for a closed set of permitted ones. Excellence moves you along the residual. Only enumeration moves the boundary that decides whether a residual exists at all.

So when a vendor tells you their model has improved, ask whether the improvement changed the shape or only the score. If a control’s guarantee gets stronger every time the underlying model does, it is a guardrail. If it holds identically whether the model is the best there is or a stub, it is a gate.

VI. The Case Against This Essay

Where I argue against my own instrument.

I would not trust this argument if I did not state the strongest objections to it, and none is a fig leaf.

(a) Allowlists are genuinely costly, and the cost is not a footnote. A closed, enumerated permitted set has to be enumerated by someone, and that someone can get it wrong. Draw the set too narrowly and the gate fails closed on legitimate work: the credit officer’s agent is denied a step it should have been allowed, the memo stalls, and a human has to intervene on a task that was never dangerous. This is not a theoretical wrinkle; it is the daily tax of the shape I am defending. A badly-drawn allowlist is brittle, it over-refuses, and it pushes a real cognitive burden onto whoever owns the enumeration. The gate’s guarantee is bought with that burden. If you cannot afford to enumerate your permitted actions carefully, you cannot afford a gate, and pretending otherwise would be dishonest. The blacklist’s appeal is precisely that it does not ask you to do this work up front, and that appeal is real.

(b) Rice is an idealisation, not a proof about your product. I leaned on Rice’s theorem in section IV, and a formalist is right to push back that a shipping agent does not have a literally Turing-complete action space. Its actions are bounded, its tools finite, its context windows finite. Over a genuinely bounded space, ‘is this harmful’ is not formally undecidable; in principle it is a finite, if astronomically large, decision problem. So Rice does not literally bind any deployed system, and I am not going to pretend it does. It is reinforcement and an idealisation, a way of naming why the semantic route is hostile terrain, not a lever proving a specific claim about a specific product. The load-bearing argument is the shape alone: the space is open in practice because the adversary keeps extending it, and you must enumerate an entry before you can block it. That argument stands with Rice removed entirely.

(c) I sell the gate, and you should read this knowing that. I should be plain, in my own voice and inside the case against rather than in a disclaimer at the bottom. I build and sell a deterministic enforcement kernel, the Ring Zero gate this essay prefers, and the enforceability test I keep reaching for across this series is my own ruler. I designed the instrument and I designed the argument that the instrument wins. That is a conflict of interest, and you should treat the framing as an interested one. My defence is not that I am disinterested; I am not. It is that the argument is exposed to a falsifier that does not depend on me at all: exhibit the complete decidable blacklist and I lose, regardless of what I sell. Test it against that, not against my incentives.

(d) Real systems run both, and the honest claim is narrow. Nothing here says guardrails should not exist. A good production stack runs a classifier and a gate together: the classifier catches a great deal cheaply and improves the odds, the gate refuses the specific unenumerated action at the moment of action. They do different jobs and the classifier’s job is worth doing. My claim is not that one shape should exist and the other should not. It is narrower: only one of the two shapes can refuse a specific unseen action at the moment of action, by construction, without having to recognise it first. Which shape can refuse is the whole of the claim. Which shape should exist is not a question I am answering.

(e) The gate refuses the un-enumerated, not the unsafe, and those are not the same set. This is the objection that cost me the most, so I will state it at full strength rather than soften it. The gate’s by-construction guarantee is precise and narrow: it deterministically denies any action outside Pi, and it mediates every access completely. That is a necessary condition for safety. It is not a sufficient one, and the gap matters. Harm can re-enter through three doors the per-action shape does not close. The first is the argument to a permitted action: attach_memo_draft is a member of Pi, so attaching a memo that carries a coverage ratio of 2.82 when it should read 1.82 is a permitted action with a poisoned payload, and a gate that tests the action rather than the value permits it by construction. The second is accumulated state, where each step is allowed but the standing position they build is not. The third is the trajectory: an unsafe outcome assembled entirely from individually-permitted steps, no un-enumerated edge ever firing, which is this series’ own orchestration drift, where no single transition violates policy and the sequence still does. To close Pi at the level of arguments or trajectories would be to enumerate an open space again, the very blacklist problem section IV calls unwinnable. So the guarantee binds only at the granularity where Pi is genuinely closed: it is strongest for a narrow-tool agent like the four-action credit memo, and weakest for an open-ended agent that can browse, write code and send mail, where the set of permitted arguments and sequences is itself effectively open. Catching harm at the argument and trajectory level needs deterministic verifiers over the payload, and whether those verifiers can be complete over an open argument space is a separate, unresolved question. It is the subject of Part 4. The gate is the necessary floor. It is not the whole building.

VII. Coda

The shape is the thing.

Return to the credit officer. The agent is composing its memo, and the same non-human-readable input arrives carrying the same one-word instruction: release. Under the gate, the agent is permitted the steps that sit in its frozen set, reads the ledger, computes the ratio, drafts the memo, requests approval, and when the injected instruction resolves into an action to release without the approval step, the gate finds no transition for it. Not because it recognised the attack. Because the action was never on the list. It refuses the thing it has never seen, which is the one thing a classifier can never promise, because a classifier can only refuse what it has learned to recognise, and this was designed not to be recognised.

I have to hold that win at its true size, because I spent a whole section conceding its edge. The gate refuses the release it never enumerated. It would not, on its own, catch the same attack rerouted through an action it did enumerate, a permitted step carrying a poisoned value, and catching that takes a verifier over the payload, which is the next part’s problem. What the gate guarantees is the un-enumerated denial, deterministically and independently of the model. That is a necessary floor, not a finished safety case, and it is still the one thing the classifier cannot offer.

That is the difference in shape, and shape was the whole of the claim. Capability improves the blacklist’s odds forever and its completeness never. Quality moves you along the residual; shape decides whether a residual exists at all. You cannot enumerate the bad, because the bad is an open list someone else is still writing. You can only enumerate the good, close the set, and deny the rest by construction, and then verify the payload of what you permitted, which is where this series goes next.