If there's one architectural decision behind everything else in Steelmoth, it's this: the part of the system that's clever is never the part that grants permission.

The model proposes. A separate component — small, dumb, auditable — decides whether the proposal is allowed. The clever part can be tricked, mistaken, novel-prompted into doing things it shouldn't. The deciding part can't, because it isn't reasoning. It's just checking the proposal against the rules.

The model proposes. The system decides.

This sounds like a small thing. In practice it's the whole product. Every promise we make — about injection resistance, about scoped memory, about the audit log meaning what it says — rests on that one separation.

What that buys you.

A clever prompt can't talk Steelmoth into acting outside your rules. A poisoned email can't either, because the part that reads the email isn't the part that has authority. And if Steelmoth ever claims it did something, the claim is checked against what actually happened — because the claim and the doing are also separate.