What Vortalis does not defend against.

Reliable goal-drift detection is an open AI safety research problem. Vortalis provides per-session trajectory indicators (change-point analysis, intent-vs-action divergence) which are useful as forensic signals after the fact. They are not a guarantee that an agent will not drift inside a session, and they do not promise to detect a patient adversarial drift that stays inside the indicator's sensitivity. We provide the forensics; we do not prevent the drift.

An adversary that models the proxy can probe its denial surface and adapt. Vortalis raises the cost of this attack: denial reasons are sealed to the agent and visible only in the operator audit chain, and rate limits short-circuit the volume of training signal an adversary needs to fit the policy. These controls increase the work required, they do not close the problem. Continuous detector retraining is the operational answer; the platform's defence improves over time and is not static.

Vortalis sees the delegation graph between agents. Where two agents act in concert by direct delegation, joint-action policy rules can deny the second action. Where two agents coordinate through a neutral third service without any delegation being recorded (a shared mutable state on an unrelated system, for example), there is no delegation graph to evaluate. Correlation-based detection over shared-service activity is on the research roadmap, not in production.

Protocol-level governance is not the right layer for AGI containment. We will not pretend otherwise. What Vortalis does provide remains meaningful even in the presence of a much more capable agent: forensic evidence of every action, authority termination via scoped kill switches, and a cryptographically attested audit chain that an independent auditor can verify offline. These are forensics and revocation tools. They are not containment.

An instruction carried in an image or audio input, invisible to text-only detection, is a model-capability problem. Vortalis supports adapter-level mode whitelists (operators can declare that an agent may not consume image input, for example), which is a hard constraint, not a defence. The defence against the underlying threat lives at the model-provider layer, not at the governance proxy layer.

Our scope begins at the agent's first boundary call. A compromise of the underlying model provider, or of the model weights themselves, is outside what a runtime governance proxy can observe or prevent. Where an operator's threat model includes the model provider, additional controls at the model-provider boundary (separate signing keys, dedicated inference infrastructure, attested model artefacts) are needed alongside Vortalis, not within it.