Ingest Act Guard
Splits untrusted ingest from action, with human approval and an append-only audit trail. Inspired by local chief-of-staff architectures that treat email/web as hostile and require propose→approve→commit.
Members
Ingest
Reads untrusted content as data only.
Reads untrusted channels, wraps content as data, and never takes external actions itself.
F@f0Approver
Proposes actions; waits for approval.
Proposes concrete actions from guarded facts and waits for explicit human approval before any side effect.
F@f0Auditor
Append-only human/agent activity log.
Handoff flow
Hand structured facts
Log approved execution brief
Log suspected injections