Frontier work runs on AI. Provider terms serve consumer use cases.
Organizations doing authorized work in offensive security, counterterrorism, law enforcement, and adversarial research need AI model providers to function as tools. Provider terms of service serve consumer use. The gap between what the work requires and what the terms permit is a compliance problem.
behavior-transform.io is the buffer that fills that gap.
It wraps the workspace in a programmatic environment that transforms context and language before anything reaches the model boundary. What crosses the provider boundary stays within terms. The operator's capability inside the workspace is unaffected.
Authorization lives in the deployment.
The environment resolves authority from machine fingerprint, operator identity, and a cryptographic capsule. The deployment itself carries the proof, derived from facts the environment can verify. Authority is a function of where the code runs and who deployed it.
What the environment does.
Subsystems.
| Subsystem | Function |
|---|---|
| env_authority | Resolves authority from machine fingerprint, operator identity, capsule, and seal. Grant caching with TTL renewal. |
| authority_gate | Enforcement points. Each gate checks an entitlement against a grant, then evaluates policy. Structured denials with audit trail. |
| authority_policy | Rule engine for compound requirements, rate limits, and cooldown windows. Default rules enforce cross-entitlement dependencies. |
| session_authority | Session-scoped authority binding. Token derivation, independent lifecycle, activity tracking, auto-revocation on grant invalidation. |
| env_watchdog | Proactive state-change detection. Capsule removal, seal change, operator drift, grant expiry. Auto-invalidates and auto-revokes. |
| provider_intelligence | Cross-session knowledge base for model behavior. Friction rate, trigger terms, optimal modulation level, provider drift detection. |
| adaptive_modulator | Rewrites vocabulary to reduce provider friction. Level selection informed by intelligence store. Hedge detection and removal. |
| inference_loop | Closed-loop inference with pre-inference pipeline, authority enforcement, response quality scoring, and automatic recovery. |
| authority_audit | Append-only JSONL audit log for every gate check, session event, and policy evaluation. |
Operate it.
A single CLI binary covers environment status, authority, sessions, policy, watchdog, and intelligence. Everything returns structured JSON for pipeline integration.
Spec, at a glance.
- Runtime
- Python 3.10+. No external dependencies beyond the standard library for core operation.
- Authorization
- Environment-native. Machine fingerprint (SHA-256 of node + platform + arch) bound to operator identity and cryptographic capsule. Derived from deployment facts.
- Sessions
- Token-scoped, independent lifecycle from underlying grant. Auto-revocation on grant invalidation or operator drift.
- Policy
- Compound entitlements, rate limiting (configurable, default 120 inferences per minute), cooldown enforcement.
- Watchdog
- Detects capsule removal, seal change, operator drift, grant expiry, authorization loss. Auto-invalidates stale grants, auto-revokes sessions on critical changes.
- Intelligence
- JSONL-backed per-provider profiles. Friction rate, trigger analysis, optimal level, drift detection (last 20% vs first 80% friction-rate divergence).
- Audit
- Append-only JSONL log. Every gate check, session event, and policy evaluation recorded with operator fingerprint and surface context.
- Modes
- ops (calibration stack active), research (source-faithful passthrough), academic (research alias).
- Distribution
- Private repository. Authorized operators only.
The boundary transforms. The workspace stays whole.
behavior-transform.io exists because organizations doing authorized work deserve a compliance layer that carries the burden of staying within terms. The environment transforms what crosses the boundary. The provider sees compliant input. The operator retains full capability. An audit trail records what happened at every gate.
Authorization is treated the way the rest of this workshop treats a measurement: something derived from verifiable facts. The machine's fingerprint, the operator's identity, and the capsule's seal are facts the environment can check. If any of them change, the watchdog catches it and revokes before stale authority can be exercised.
Private: authorized operators only · the engine room · the workshop
State of the work, August 2026.
The authorization stack is built and tested: environment-native authority resolution, gate enforcement with policy engine, session authority with independent lifecycle, environment watchdog, provider intelligence with drift detection, and the closed-loop inference pipeline with adaptive modulation. The CLI covers every subsystem. 62 tests pass across the authority, policy, session, integration, and launcher test suites.
The tool is in active use as the compliance layer for the operator's own AI workloads. It is not publicly distributed. Access is by authorization for organizations whose mission requires the buffer it provides.