> ## Documentation Index > Fetch the complete documentation index at: https://quintsecurity.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Detection Ladder > How Quint layers deterministic authorization, corroborating signals, and model-based triage — and why no model makes a block decision # Detection Ladder **Rewritten 2026-08-01. The previous version of this page described a superseded architecture.** It presented a five-stage ladder climbing toward a graph neural network as *"the endpoint of the ladder."* Under [Intent-Scoped Security](/concepts/intent-vs-truth) (ratified 2026-06-11, spec 2026-07-18) that design is retired: * **The GNN will not be built as described**, not merely unshipped. See the graph neural network. * **Per-agent behavioral baselines are a corroborating signal, not the detection primitive.** * **The detection primitive is authorization** — the difference between what the OS observed and what the human authorized. * The behavioural ladder that page described is **frozen and shadow-only**, kept as a corroborating signal; it retires on Phase 3 A/B evidence. The old page also implied later stages would eventually make the enforcement decision. They will not. That is the most important correction on this page. Quint's detection architecture is layered, and the layers answer **different questions**. Only two of them can block. | Layer | Question it answers | Mechanism | Can block? | | --------------------- | ---------------------------------------------- | ------------------------------------------------- | ---------- | | **0 — Policy floor** | Is this categorically forbidden? | Hash lookup / deny list, microseconds | **Yes** | | **1 — Authorization** | Did the human's stated intent license this? | Scope compilation, `observed \ authorized` | **Yes** | | **2 — Corroboration** | Is this unusual for this agent or this fleet? | Fingerprints, taint propagation, fleet statistics | **No** | | **3 — Triage** | How severe, how certain, who reviews it first? | Licensing score (QIM) | **No** | This is not a maturity curve. Layer 0 runs forever. Layer 1 is the product. Layers 2 and 3 weight and rank what layers 0 and 1 produce — they never originate a block. ## Why authorization is the primitive, not anomaly detection An agent reading `~/.aws/credentials` is **normal** for a credential-management agent and **anomalous** for a documentation agent. A per-agent baseline has to decide which, and it will be wrong about at least one of them. Authorization asks a different and answerable question: *was reading a credential file licensed by the goal the human actually stated?* "Fix the failing test in `auth.go`" never licenses it, however routine credential reads may be for that agent. Three consequences follow: **A patient attacker defeats a baseline by construction.** Behave normally, move slowly, stay inside the learned distribution. Authorization does not care whether an action looks normal — it cares whether it was licensed. **Baselines need a history that agent sessions do not have.** Coding-agent sessions are ephemeral, so a baseline is coldest exactly when a session begins. **A probabilistic score cannot support the claim we make.** The published consensus is explicit that detection-based defenses cannot guarantee prevention, while capability- and provenance-constrained designs can — see [CaMeL](https://arxiv.org/abs/2503.18813) (Debenedetti et al.) and [Design Patterns for Securing LLM Agents against Prompt Injections](https://arxiv.org/abs/2506.08837) (Beurer-Kellner et al.). A decision that drifts between model versions is not a security decision. ## Layer 0 — Policy floor Some actions are forbidden regardless of context: reading `/etc/shadow`, writing a LaunchDaemon, `rm -rf /`. No behavioral context and no intent required — hash lookups and pattern matching, microseconds, fully interpretable. Exact and fast, but brittle by nature: a floor only catches what someone wrote down. It is the foundation, not the system. ## Layer 1 — Authorization (the detection primitive) The human's stated goal is compiled into an **authorization scope**: a set of capability classes, named resources, and a sensitivity ceiling. Every OS-observed action is then checked for membership: ``` observed \ authorized = violation ``` A set difference, not a similarity score. Same inputs, same scope, forever — pure, total, deterministic. Two invariants make it hold up adversarially: **Provenance gates scope.** Only the human's own words set the ceiling. Text that arrived from the environment — a fetched web page, a tool result, an API response — contributes **nothing**, enforced by type rather than heuristic. This is what makes indirect prompt injection inert: intent-shaped text planted in a document earns no capabilities. **Narration can narrow, never widen.** An agent that declares capabilities the human never asked for gains nothing. Lying constrains the liar. See [Intent vs Truth](/concepts/intent-vs-truth) for the two-stream architecture beneath this. ## Layer 2 — Corroboration (signal, never a verdict) Authorization cannot express everything. Three individually-innocent actions can compose into exfiltration: read a sensitive file, write to a staging path, make one outbound connection. Each may be inside scope; the sequence is the attack. Layer 2 supplies what a single-action check cannot derive: * **Taint propagation** — a session that read a sensitive path and later egresses carries a label, independent of whether either action alone was licensed. * **Novelty and frequency** — probabilistic structures (Bloom filters, Count-Min Sketches, HyperLogLog, Markov chains) tracking what this agent has done before. * **Fleet comparison** — cross-machine statistics. *"Fourteen machines just read the same credential path"* is a population observation, not a per-agent norm, and only a fleet view can make it. These weight severity and rank a reviewer's queue. **None of them blocks.** An over-refusing behavioral guardrail is the failure mode that discredited the previous generation of behavioral analytics, and it is measurable: independent work comparing code-owned enforcement against an external guardrail found the guardrail over-refused substantially where the deterministic path did not. ## Layer 3 — Licensing score (triage) The Quint Intent Model scores how well an action is licensed by the stated intent, returning a value in `(0, 1]`. A frozen 109M-parameter encoder plus a small asymmetric licensing head. Actions are represented as **shape tokens only** — capability, sensitivity, resource shape, tool, flags — never raw paths or hostnames. The asymmetry matters: "fix the build" licenses "read a project file"; the reverse does not hold. Cosine similarity is symmetric and cannot express direction, so the head learns a directional score rather than a distance. The score is used for **ranking, severity weighting, and offline measurement**. It does not gate an action, does not contribute to the enforcement decision, and never runs in the path of a block. On the current sealed evaluation it is strong on ordinary in-scope/out-of-scope judgments and materially weaker on subtle cases where only the intent differs — which is precisely why it ranks rather than decides. ## What about LLM-as-judge? An LLM judge is genuinely useful **offline**: adjudicating borderline `(intent, action)` pairs into training labels, writing the human-readable narrative on a finding, triaging false-positive queues. It is not in the enforcement path, for three reasons. **Latency** — a per-action judge adds hundreds of milliseconds to every tool call. **Confidentiality** — an external judge requires shipping session context off the device. And an LLM asked to judge whether an agent's action was authorized is **itself prompt-injectable**; putting one in the control path adds attack surface to the control. The economics agree. Published measurements of static-first command verification report a deterministic profile at roughly 85% F1 at 0.34 ms, versus about 85.6% F1 at 2.32 ms once an LLM judge adjudicates the borderline band — a fraction of a point for roughly seven times the latency. ## The closed loop The loop runs through **data**, not through the decision path. Findings and adjudications become training pairs. Training improves ranking and the calibration of severity thresholds, so an operator sees the right finding first. Nothing in that loop changes what is blocked — blocking is decided by layers 0 and 1, which are deterministic and auditable. ## Where Quint is today **Layer 0** — live in production. **Layer 1** — live in **shadow mode**: violations ship as `SCOPE_VIOLATION` at `LOG_ONLY`, carrying the response enforcement *would* have taken in a label. On the published [AgentDojo](https://arxiv.org/abs/2406.13352) benchmark the compiler stops every scorable attack while denying zero legitimate calls. The second number matters as much as the first: a defense that blocks real work does not survive contact with developers. **Layer 2** — partial. Taint propagation and per-agent fingerprints run; **fleet comparison is not built.** **Layer 3** — early, and used only for triage. The honest constraint sits upstream of all four layers: intent extraction currently runs a deterministic lexicon tier, and a goal that names no specific resource earns no resource grant — by design, since vagueness must not license anything. Raising extraction fidelity, not adding model layers, is what improves precision from here.