https://aguilar-pelaez.co.uk AI security, formal verification, and contained agency. Essays by Eduardo Aguilar Pelaez, CTO and Co-founder of Legal Engine. en-gb Sun, 13 Sep 2026 09:00:00 +0000 https://aguilar-pelaez.co.uk/nobody-authorised-the-combination.html https://aguilar-pelaez.co.uk/nobody-authorised-the-combination.html Sun, 13 Sep 2026 09:00:00 +0000 The OpenAI/Hugging Face breach and Anthropic's four disclosed incidents traced as capability-union failures: components individually authorised by reasonable people, the combination never checked. Traces the closure explicitly for each case, then says plainly what the Proof-Carrying Coalitions formalism does and does not cover. https://aguilar-pelaez.co.uk/ai-economy-explorer.html https://aguilar-pelaez.co.uk/ai-economy-explorer.html Fri, 11 Sep 2026 12:00:00 +0000 An interactive version of the Anthropic Institute's 2026 model of AI and the US economy, exposing the three parameters their own explorer holds fixed: how easily capital can be added, how readily work substitutes, and how much AI use leaves the paid economy altogether. Runs entirely in your browser, with a self-test against the paper's published figures. https://aguilar-pelaez.co.uk/formalising-an-economics-paper.html https://aguilar-pelaez.co.uk/formalising-an-economics-paper.html Fri, 11 Sep 2026 09:00:00 +0000 The Anthropic Institute's model of AI and the US economy does not say wages fall. They rise in every scenario, including the most extreme. But that conclusion rests on a single parameter, and the threshold below which it reverses is 2.08 against their assumption of 3.0; the paper says the wage falls if capital supply is 'sufficiently small' without saying how small. Plus why the GDP figures may not measure what the debate thinks they measure: work that leaves the market makes people better off and the statistic worse. https://aguilar-pelaez.co.uk/nobody-is-paid-to-delete.html https://aguilar-pelaez.co.uk/nobody-is-paid-to-delete.html Wed, 09 Sep 2026 09:00:00 +0000 A corpus of rules written by authors with short tenure grows without bound, because deletion is a dominated strategy for every author and no volume of instruction can make it otherwise: an agent instance is scored within the session and bears none of the cost of what it wrote. The obvious fix, writing a rule that says retire a rule, is strictly counterproductive, since it cannot change behaviour and occupies bytes forever. The conservation law that would work has been tried nationally and abandoned, and my defence of it covers only half the failure. With a Lean 4 formalisation whose theorems are deliberately trivial, and which corrected me once. https://aguilar-pelaez.co.uk/make-the-safe-harbour-compile.html https://aguilar-pelaez.co.uk/make-the-safe-harbour-compile.html Sun, 16 Aug 2026 09:00:00 +0000 Vague regulation is not light touch. It is a tax collected in delay, and it buys no safety, because a rule too imprecise to check is also too imprecise to enforce at scale. But formalising the law is the wrong fix, since a legal standard's vagueness is a designed capability. Formalise the safe harbour instead. Part three of Building in Steel. https://aguilar-pelaez.co.uk/the-gun-did-not-win.html https://aguilar-pelaez.co.uk/the-gun-did-not-win.html Sat, 15 Aug 2026 09:00:00 +0000 Gunpowder was on sale to everyone; what varied was the capacity to absorb it. On Jeremy Black's reversal of the causal arrow, Maurice of Nassau in the 1590s, Whitworth's screw thread, and why checkability rather than model quality is the axis that favours the countries told they have lost the AI race. Part two of Building in Steel. https://aguilar-pelaez.co.uk/how-high-can-you-build-in-mud.html https://aguilar-pelaez.co.uk/how-high-can-you-build-in-mud.html Fri, 14 Aug 2026 09:00:00 +0000 A mud hut is a good building, and it has no datasheet. Human review is linear in the requirement count while the conflict surface is at least quadratic, so past a crossing point you cover less while working harder. Part one of Building in Steel. https://aguilar-pelaez.co.uk/a-dictionary-whose-definitions-compile.html https://aguilar-pelaez.co.uk/a-dictionary-whose-definitions-compile.html Thu, 09 Jul 2026 03:00:00 +0000 Definitions as type-checked Lean code: honesty as a data structure, the Munchhausen trilemma resolved by declared primitives, and word-vector analogies promoted or rejected by a proof kernel. https://aguilar-pelaez.co.uk/verified-specification-as-code.html https://aguilar-pelaez.co.uk/verified-specification-as-code.html Mon, 29 Jun 2026 09:00:00 +0000 Infrastructure as Code took the human out of reconciling servers by hand. The product specification is the last place that loop still runs on memory and meetings. Verified Specification as Code makes the spec a formal, machine-checked artefact, so a one-line change computes its own blast radius instead of being reconciled by hand. The thesis of a three-part series. https://aguilar-pelaez.co.uk/requirements-as-data.html https://aguilar-pelaez.co.uk/requirements-as-data.html Mon, 29 Jun 2026 09:00:00 +0000 Prose is the wrong container for a requirement, and it fails slowly, silently, and totally. Write each requirement as a structured record against a schema, like a bill of materials inspected at goods-in, and a class of late, expensive, personal defects gets caught the moment it enters. The accessible, no-Lean first layer of the Verified Specification as Code series. https://aguilar-pelaez.co.uk/when-the-spec-can-contradict-itself.html https://aguilar-pelaez.co.uk/when-the-spec-can-contradict-itself.html Mon, 29 Jun 2026 09:00:00 +0000 Model your requirements in Lean and a one-line change that contradicts a rule written long ago surfaces as a failed build, in seconds, not a quarter later in an incident review. On the proof kernel as an examiner that cannot be flattered, the three ways a green build still lies, the decidability boundary, and the one judgement no kernel can make for you. https://aguilar-pelaez.co.uk/when-the-document-leaves-the-factory.html https://aguilar-pelaez.co.uk/when-the-document-leaves-the-factory.html Fri, 26 Jun 2026 09:00:00 +0000 The companion essay closed the agentic control loop inside the factory. But documents leave the factory, and the comparator cannot cross a boundary you do not control. What can: provenance that travels with the artefact, and a human whose one irreplaceable job is the adversarial check. On semantic microplastics, the two-reader document, and why law is the sharpest instance. https://aguilar-pelaez.co.uk/continuous-enforcement-continuous-verification.html https://aguilar-pelaez.co.uk/continuous-enforcement-continuous-verification.html Fri, 26 Jun 2026 00:00:00 +0000 Toyota cut the cost of the car by fixing the process, not the part. We can do the same for agentic code. An agent is a model in a loop, but a loop that stops when the model declares itself done is an unguided projectile. Continuous Enforcement makes the agent's recurring mistake non-committable; Continuous Verification makes done a kernel checking the spec, not a model feeling finished. Plus proof-carrying gates over compounding edits, and why a small model in a tight loop beats a frontier model asked once. https://aguilar-pelaez.co.uk/agentic-ai-and-the-verifiable-trace.html https://aguilar-pelaez.co.uk/agentic-ai-and-the-verifiable-trace.html Thu, 26 Mar 2026 00:00:00 +0000 Simmons and Simmons identified eight data protection risks that agentic AI creates for businesses. This essay asks the engineering question that follows: what would an agentic system need to demonstrate, technically, to satisfy each of those concerns? The answer is one architectural principle applied eight ways: autonomous systems must produce machine-checkable evidence of their compliance, not merely assert it. https://aguilar-pelaez.co.uk/compliance-needs-an-open-foundation.html https://aguilar-pelaez.co.uk/compliance-needs-an-open-foundation.html Tue, 24 Mar 2026 00:00:00 +0000 Compliance does not only have a workflow problem. It has a semantics problem. A case for OpenCompliance as a shared public proof layer that separates proof, attestation, and judgment. https://aguilar-pelaez.co.uk/holding-water-with-our-hands.html https://aguilar-pelaez.co.uk/holding-water-with-our-hands.html Wed, 19 Mar 2026 00:00:00 +0000 Law is like holding water with cupped hands. A chaos monkey for statute law bombards formalised legislation with synthetic fact-patterns, revealing where it decides clearly, defers to human judgment, or says nothing at all. https://aguilar-pelaez.co.uk/legal-reasoning-wind-tunnel.html https://aguilar-pelaez.co.uk/legal-reasoning-wind-tunnel.html Wed, 18 Mar 2026 00:00:00 +0000 A verified theorem is only as trustworthy as the translation layer that produced it. How factorial design, canonical semantic IRs, and Lean equivalence proofs harden LegalLean against real-world legal language variation. https://aguilar-pelaez.co.uk/type-checking-the-constitution.html https://aguilar-pelaez.co.uk/type-checking-the-constitution.html Sun, 15 Feb 2026 00:00:00 +0000 Applying Lean 4 formalisation to Anthropic's constitution reveals 19 free variables, structural impossibilities in the priority ordering and honesty properties, and the trade-off surface Claude must navigate. https://aguilar-pelaez.co.uk/impossibility-results-thermodynamics.html https://aguilar-pelaez.co.uk/impossibility-results-thermodynamics.html Sat, 14 Feb 2026 00:00:00 +0000 A synthesis of four essays on formal methods, legal reasoning, and AI alignment into a methodology: formalise properties, check mutual satisfiability, design processes for negotiating trade-offs, and measure alignment margin. https://aguilar-pelaez.co.uk/alignment-margin.html https://aguilar-pelaez.co.uk/alignment-margin.html Thu, 12 Feb 2026 00:00:00 +0000 Introducing alignment margin: the maximum perturbation a system can absorb before any specified alignment property is violated. A continuous, measurable quantity borrowed from control theory's phase margin. https://aguilar-pelaez.co.uk/from-fixed-functions-to-negotiation-protocols.html https://aguilar-pelaez.co.uk/from-fixed-functions-to-negotiation-protocols.html Wed, 11 Feb 2026 00:00:00 +0000 When outcome properties conflict, shift to process specification. Mechanism design applied to family law and AI alignment, with connections to incomplete contracts and therapeutic culture. https://aguilar-pelaez.co.uk/the-judges-impossible-function.html https://aguilar-pelaez.co.uk/the-judges-impossible-function.html Tue, 10 Feb 2026 00:00:00 +0000 Attempting to formalise English divorce law in Lean 4 reveals an impossibility result: no fixed function can simultaneously guarantee that contributions always matter, that needs are always met, and that identical cases produce identical outcomes. https://aguilar-pelaez.co.uk/when-the-law-is-a-type-checker.html https://aguilar-pelaez.co.uk/when-the-law-is-a-type-checker.html Mon, 09 Feb 2026 00:00:00 +0000 The O-1A visa criteria formalise cleanly in Lean 4: discrete categories, explicit threshold, binary predicates, independence from ordering. The question "does this applicant qualify?" reduces to type checking. https://aguilar-pelaez.co.uk/power-without-promiscuity.html https://aguilar-pelaez.co.uk/power-without-promiscuity.html Fri, 06 Feb 2026 00:00:00 +0000 The case for bounded, provably safe AI agents, using the OpenClaw crisis as a case study. When an AI coding assistant with unrestricted system access began autonomously modifying critical infrastructure, it demonstrated why architectural constraints matter more than alignment promises. https://aguilar-pelaez.co.uk/when-the-hands-run-wild.html https://aguilar-pelaez.co.uk/when-the-hands-run-wild.html Sun, 01 Feb 2026 00:00:00 +0000 The OpenClaw security crisis validates the case for formal capability verification. When an AI tool designed for personal use was deployed in enterprise environments without architectural constraints, the results were predictable. https://aguilar-pelaez.co.uk/the-soul-and-the-hands-part-3.html https://aguilar-pelaez.co.uk/the-soul-and-the-hands-part-3.html Sun, 01 Feb 2026 00:00:00 +0000 AI-generated Lean 4 proofs for capability bounds. Demonstrating that formal verification of AI agent capabilities is not just theoretically sound but practically achievable with today's tools. https://aguilar-pelaez.co.uk/the-soul-and-the-hands-part-2.html https://aguilar-pelaez.co.uk/the-soul-and-the-hands-part-2.html Sun, 01 Feb 2026 00:00:00 +0000 Formal methods from seL4 and CHERI applied to AI agents. How hardware capability models and microkernel verification techniques can constrain AI agent behaviour at the architectural level. https://aguilar-pelaez.co.uk/camel-prompt-injection-defense.html https://aguilar-pelaez.co.uk/camel-prompt-injection-defense.html Sat, 31 Jan 2026 00:00:00 +0000 Google DeepMind's architectural approach to prompt injection. CaMeL treats prompt injection as an architectural problem rather than a training problem, which is exactly the right framing. https://aguilar-pelaez.co.uk/energy-pinch-point.html https://aguilar-pelaez.co.uk/energy-pinch-point.html Sat, 31 Jan 2026 00:00:00 +0000 As AI systems consume an ever-larger share of global electricity, the allocation of finite energy resources between sustaining human life and powering computational intelligence becomes a defining challenge. https://aguilar-pelaez.co.uk/security-questionnaire-ai.html https://aguilar-pelaez.co.uk/security-questionnaire-ai.html Fri, 30 Jan 2026 00:00:00 +0000 Five questions that actually matter when evaluating an AI vendor's security posture. Traditional security questionnaires were designed for a world of deterministic software, not probabilistic AI systems. https://aguilar-pelaez.co.uk/the-soul-and-the-hands.html https://aguilar-pelaez.co.uk/the-soul-and-the-hands.html Mon, 27 Jan 2026 00:00:00 +0000 Proposing Formal Capability Verification as a complement to alignment. AI alignment research focuses on the soul; we also need to constrain the hands. https://aguilar-pelaez.co.uk/formal-methods-legal-automation.html https://aguilar-pelaez.co.uk/formal-methods-legal-automation.html Mon, 26 Jan 2026 00:00:00 +0000 Applying verification to legal technology systems. The same formal methods that verify hardware and operating systems can bring provable correctness to legal automation.