Enforcement by construction.

The review industry's best tools read finished code and estimate whether it's dangerous. The strongest of them catch roughly half of real runtime bugs — after the code exists, on every pull request, forever. That's a smarter reviewer. It is still a probability.

Garnet moves the question earlier and makes it binary. What code is allowed to do — which files, which network, which processes, which delegated authority — is written as a capability type. Where the trap is proven — the bounded, pinned Gate‑1 surface in the boundary section below — code that invokes authority it never declared isn't flagged for a human to weigh: it fails, deterministically. The wider surface is declared (checker‑only) today, being built to that same standard.

The industry's own principle says the AI that wrote the code shouldn't be the one reviewing it. Its answer is a second model. Garnet's answer is a checker. A compiler doesn't have opinions; it has verdicts — and a verdict is the only kind of review that doesn't get tired, doesn't get noisy, and doesn't get argued past.

The AI‑first crisis isn't that agents write bad code. It's that juniors and agents can't be trusted to ship unreviewed — so senior engineers became full‑time reviewers, and their judgment became the scarcest resource in the org. Every review tool on the market re‑spends that judgment on every change. Process must be re‑applied every time.

A type applies once. Garnet doesn't replace senior judgment — it changes what it's spent on. One senior encodes the security envelope as capability types: what this service may touch, what this agent may delegate, what this module may never do. That is the design; what is proven today is narrower — the deterministic traps named in the boundary section below — with the full envelope vocabulary declared (checker‑only) and built toward the same standard at zero marginal senior attention.

Review time then becomes taste time. Humans argue about the things worth arguing about — naming, architecture, product — because the floor is no longer up for debate.

Multi‑agent topologies are the default now. Orchestrators spawn sub‑agents that spawn sub‑agents, and the newest frontier models improvise their own delegation patterns — sub‑agents mutating parent state, cleanup routines inheriting kill‑anything scope from the top of the tree. Charming when it's benign. Nothing granted it; nothing could have denied it.

Prompts can't enforce attenuation. Connectors don't attenuate. Skills don't compose permissions. Garnet's design puts a capability lattice in the type system: a delegated capability is constrained to a subset of the delegator's, so authority narrows at every edge of the tree — whatever the model, however novel its orchestration style. The machine‑checked proof of that lattice is in progress, not complete; until it lands, this is a design commitment, not a shipped guarantee.

The swarm keeps its creativity. What the design takes from it is ambient authority — the difference between hoping your fleet behaves and building toward a fleet whose authority is bounded by an envelope the toolchain checks.

Aerospace, defense, healthcare — the buyers who matter don't accept "an AI reviewed it and said it was fine." A comment thread is not an artifact. A chat log is not a control. When the auditor asks how you know, they mean something you can hand over.

The planned garnet build --evidence flag — no such build flag exists in the shipping CLI today — is designed to emit a Verifiable Evidence Bundle with the build: what this code is capable of, what it is incapable of, and the capability declarations those facts derive from. What is a consultant engagement today — weeks of humans reading documents — would become a compiler flag that runs on every build.

That is the roadmap, not the present: evidence stops being a deliverable you assemble for the audit and becomes exhaust the toolchain produces anyway. Until that flag ships, the runnable surface is garnet caps, garnet diff-caps, and garnet seal. No authority without evidence — and no evidence without a check that proves it.

For a few years, frontier labs kept a lid on dangerous capability by training their models to refuse. That era is closing. Frontier‑class open‑weight models now ship with little or no safety posture — they will run the offensive task, the swarm audit, the kernel exploit, for anyone, and their weights live on hardware nobody governs.

You can no longer locate trust in a model's disposition. A refusal is a property of one vendor's checkpoint; your security has to hold across every model your org and your adversaries will ever run. And the trust engineers are now extending to agents is behavioral — earned per checkpoint, per month, per "it cheats less than it used to." It doesn't transfer to the next model, the fine‑tune, or the open‑weight drop. Every unit of earned trust converts directly into expanded autonomy — less human review, longer unattended runs — which raises, not lowers, the cost of the day that trust is wrong. So trust moves down — out of the model, into the substrate the model's output must pass through.

Garnet is that substrate. Enforcement in the type system is model‑agnostic by design: a compiler's verdict doesn't depend on which model wrote the code or how persuasively it argues. Today that verdict covers the bounded, pinned surface stated below — not a universal sandbox — and every widening must arrive with its own trap. The less you can trust the author of the code, the more that property is worth.