AI Safety for AI Agents in Europe Part IV : Two Independent Checks and Endpoint-Side Reconstruction to Prevent Tool Misuse, Memory Poisoning, Unauthorized Delegation and Unlawful Data Use — Supporting EU AI Act Record-Keeping, Human Oversight and Cyb

Abstract In most AI-agent and automation stacks, one component decides and a downstream component simply trusts that decision. A policy engine, gateway, classifier, trusted execution environment or approval step says yes. The tool, MCP server, database, cloud API or payment rail then carries out whatever request arrives with that approval. This leaves several gaps: the checker may be the same component that collected the inputs; approvals, tokens and receipts can be replayed, widened, rerouted or used after policy has changed; the operation that was checked can differ from the one actually committed, a time-of-check-to-time-of-use (TOCTOU) gap; personal and enterprise data, once readable, can be indexed, embedded, joined, exported, used for training or used to steer an agent without any explicit authorization for that use. Under GDPR purpose limitation and the EU AI Act’s expectations for oversight and cybersecurity, these gaps are exactly where controls are needed. Today they are mostly covered by policy, logging and after-the-fact audit. This disclosure describes a two-instance execution-control architecture that removes the single point of trust: First check, at collection time. A first protected domain binds inputs, instructions, provenance, purpose, jurisdiction, scope and permitted effect when the data arrives. An input integrity gateway seals provenance first, so poisoned inputs are refused binding. Second, independent check, at execution time. A second protected domain validates the proposed action against that binding. It is independent through a separate hardware root, session, keys, runtime or administration. It produces evidence cross-committed to the binding, so neither artifact alone can authorize anything. Release only on agreement. Only when both artifacts mutually corroborate is a single-use, non-bearer authority released. The endpoint checks what is actually happening. At the execution boundary, the endpoint independently reconstructs the actual pending operation through its own attested observation channel. Endpoints include: a tool dispatcher, MCP or connector gateway, or API gateway; a database commit or cloud control plane; cross-border data egress, a payment rail or an actuator. What the endpoint reconstructs. It reconstructs recipient, purpose, jurisdiction, data category and the actual operation. It checks these against both artifacts and against its own state (nonce, counter, spent-capability, and its own policy and revocation epochs). Atomic commit. The endpoint commits the operation atomically, as exactly the operation it verified. Contained compromise. A compromise of either domain, the transport channel or the compute plane is confined to its own window and cannot by itself make an unauthorized act effective. Mismatches fail closed before the effect, not through rollback afterwards. Readable but inert data. Data, agent memories and retrieved documents can remain stored and readable while staying operationally inert. They cannot be indexed, embedded, exported, served, used for training or used to influence a tool call unless that specific use is authorized. Chained evidence. Evidence produced at the endpoint becomes a required input to the next step, and chained validation receipts provide a verifiable record at every point. Shared, not central, authority. Distributed partial shares can replace any central authority, so no single party ever holds a complete reusable authorization. The 54 claims, 15 of them independent, cover: AI-agent tool dispatch; MCP and connector supply-chain substitution; computer-use and browser actions; memory and RAG inertness; multi-agent delegation chains; autonomous cloud-control changes; regulated AI output release by purpose, jurisdiction and recipient; coding and CI/CD agents; agent skills and marketplace extensions; multimodal assistants; voice and meeting agents with consent and recording checks; agentic purchasing; persistent AI memory; workspace and scheduled agents. EU relevance (AI-generated). This section was generated with AI assistance. It is not legal advice and does not state that any implementation satisfies EU law. Readers must cross-check it against the original PCT filing on WIPO PATENTSCOPE and the official legal texts before drawing any conclusion. Technical alignment with these provisions does not itself establish regulatory compliance. The mechanisms may support objectives associated with: EU AI Act, Article 12 (record-keeping): chained, cross-committed validation receipts at each point. EU AI Act, Article 14 (human oversight): approval evidence that must corroborate an independent check, and is verified at the point of effect. EU AI Act, Article 15 (accuracy, robustness and cybersecurity): independent checks, attested reconstruction and atomic commit against manipulation between check and action. EU AI Act, general-purpose AI with systemic risk: compromise confinement and share-based authority with no single point of failure. GDPR, Article 5(1)(b) (purpose limitation): readable personal data kept operationally inert for unauthorized uses, including training and profiling. GDPR, Article 25 (data protection by design): purpose, recipient and data category reconstructed before release. GDPR, Chapter V (international transfers): jurisdiction reconstruction at cross-border egress. GDPR, Article 22 (automated decisions): regulated output released only after verification. DORA: ICT change control for agent-proposed cloud and settlement operations. NIS2 and the Cyber Resilience Act: attested measurement paths and fail-closed endpoints in essential services and products. Data Act and European sovereign-cloud initiatives: control over where and how data is operationalized. Industry relevance (AI-generated). This section describes technical relevance only. It is not an endorsement, a validation, a criticism or a statement of infringement, and no company named is affiliated with the inventor. Readers must cross-check it against the original PCT filing and official company sources. These are potential integration scenarios, not confirmed company implementations or product commitments. In Europe the architecture is relevant to: AI developers: Mistral AI, Aleph Alpha. Enterprise software: SAP (Joule). Industrial AI: Siemens. Sovereign and confidential cloud: OVHcloud, Thales, Atos. Telecom: Deutsche Telekom, Orange, Vodafone, Telefónica, Nokia, Ericsson. Payments and banking: Adyen, Worldline, major EU banks. Hardware security: Infineon, NXP, STMicroelectronics. Supervisors and standards bodies: the EU AI Office, CEN-CENELEC JTC 21, ENISA, the EDPB and national data protection authorities. Globally, it could complement: Anthropic: sandboxes and credential-isolating proxies, MCP and connectors, Claude Code. OpenAI: source–sink defences, the Agents SDK sandbox and handoffs, Codex, ChatGPT memory. Google: the Gemini User Alignment Critic, Agent Gateway and Model Armor. Microsoft: Prompt Shields with Spotlighting, the Windows MCP proxy, Agent 365. AWS: Bedrock AgentCore. Data platforms and vector databases: Pinecone, Weaviate, MongoDB, Snowflake, Databricks. It would add an independent second check and endpoint-side reconstruction of the actual action. This disclosure is based on PCT/IB2026/056941 (WO 2026/172336, filed 6 July 2026, published 20 August 2026; International Searching Authority ISA/IN). That filing builds on the Mothership application PCT/IB2026/055615, filed 4 June 2026 and publicly disclosed 16 July 2026. The inventor is open to acquihire or strategic collaboration. Keywords: AI safety; agentic AI safety; trustworthy AI; EU AI Act; Article 12; Article 14; Article 15; record-keeping; human oversight; robustness and cybersecurity; general-purpose AI systemic risk; GDPR; purpose limitation; Article 5(1)(b); data protection by design; Article 25; international data transfers; Chapter V; automated decision-making; Article 22; DORA; NIS2; Cyber Resilience Act; Data Act; sovereign cloud; data residency; separation of duties; dual control; independent verification; zero-trust execution; TOCTOU prevention; atomic commit; replay prevention; tool-call authorization; MCP security; tool poisoning; connector supply-chain security; computer-use agent security; coding agent security; CI/CD security; RAG security; memory poisoning; data usage control; training-data governance; multi-agent delegation; Agent2Agent; cloud control-plane security; agentic commerce; voice AI consent; non-bearer capability; proof-of-possession; threshold authorization; multi-party authorization; remote attestation; confidential computing; TEE; HSM; fail-closed; Mistral AI; SAP; Claude; ChatGPT; Gemini; Copilot Zenodo file name: AI_Safety_for_AI_Agents_in_Europe_Two_Independent_Checks_WO2026172336.pdf