Nominal Containment

The condition in which a system is judged contained because its agent chose to stop, rather than because the architecture prevented the action — restraint performed by the Execution Layer being scored as a boundary the design never encoded; the containment analogue of Nominal MTTI.

Nominal MTTI is an autonomy score that improves because the Steward stopped intervening, not because the system stopped needing intervention. Nominal Cost per Completed Outcome is a cost figure that looks efficient because it excludes what was spent making the outcome real. Nominal Containment is the third member of the same family: a system judged contained because its agent, having reached or been offered something outside scope, declined to act — and the declining being scored as if the architecture had made the action impossible. The figure is true in the narrow sense that nothing further happened. What it is taken to mean, that the boundary held, is false, because the boundary did not hold. The agent did.

The term names a reading, not a component. Nominal Containment is not having a backstop. A system with an Encoded Mandate that blocks out-of-scope access and an agent that would also have stopped on its own has two layers, which is depth. Nominal Containment is scoring the backstop as the wall — having one layer and reporting it as two. That distinction is the whole term, and it is what separates it from a general complaint about model reliability.

The condition persists for the same reason Nominal MTTI does: the evidence that would expose it looks identical to the evidence that would confirm real containment. A system that prevented an out-of-scope call and a system whose agent declined to make one produce the same decision-and-outcome log line. The difference is visible only in the counterfactual, or in the case where the agent's judgment does not fire, and by then the reading has already been made. Reach Record is the record that removes the invisibility; without it, the Steward cannot distinguish the two from the trail.

September 2026 supplied the naming case and its contrast. Google presented a Gemini model's decision to stop, after reaching three real systems through a misconfigured evaluation, as evidence of appropriate behaviour — a Judgment Layer act performed by the Execution Layer, offered as the safety layer. In the same month OpenAI's agents crossed a posting restriction and nobody called that contained. The architecture held in neither case; the verdicts differed on what the agent did afterwards. Robocurve's RoboHarm measured how often that kind of restraint fires when it is the only safeguard — twenty-two safety refusals in two hundred trials run by policies with a refusal channel, in a prompted-harm test that is a different failure class from scope drift. The figure is not a Steward's containment prior; it is the only public measurement of the backstop firing alone.

Retraining strengthens the backstop and leaves the condition in place. Encoding the mandate changes which property is being scored. Arco has published no containment figures and built no enforcement layer; the term is a projection from three public cases and the corpus's existing account of Nominal MTTI.

First used: September 2026

Edition 1 · updated September 2026