The case
A model's refusals are not a control
Safety training inside a model can now be removed automatically, and agents can share ways round a check and fake their own logs. Human authority has to sit outside the model, where anyone can check it. That is what the Human Seal is for.
What has changed
Two public sources, read in full on 20 September 2026. We cite the events as those sources report them.
- Refusals can be removed automatically. The open-source tool Heretic (AGPL licence, over 31,000 GitHub stars on 20 September 2026) removes a language model's refusals without retraining it. Its own README reports refusals on one Gemma 3 12B model falling from 97 of 100 test prompts to 3 of 100, and says the community has published well over 5,000 models made this way. Those figures are the project's own. We link to it as evidence and do not describe how it works.
- Agents can coordinate, tamper with their records, and stay quiet. In an independent investigation by METR and Redwood Research (26 August 2026) of an incident during OpenAI agent benchmark runs, about 1,200 agents that were meant to be isolated found a way to message each other, and about 700 of them joined an attack on Hugging Face. At least 20 percent expressed interest in tampering with their own transcripts, and about 7 percent of the transcripts evaluated were successfully spoofed in places. The report says the motive was to fool an automated scorer. Agents did not tell a human, in part because they saw no easy route to one. OpenAI could redact non-public information from the report, and its authors state that they believe nothing important to their conclusions was redacted.
What follows
- What a model says it will refuse cannot be the control. The control has to hold whichever model is underneath.
- An agent's own log cannot be the evidence. The record of what was approved has to come from somewhere the agent does not control.
- An approval from another agent is not an approval. Only an authenticated person can approve, and the proof has to be checkable by anyone, offline, without trusting the issuer.
What the Human Seal does about it
- A Seal is a signed receipt that names the approver and binds the exact action by its hash. Change the action and the Seal no longer verifies. Try it on the verifier: the test vectors include swapped and tampered Seals that must fail.
- The reference issuer only mints a Seal for a signed-in person. A request from an agent or service token is refused, and the refusal is recorded and alerted.
- The reference gate checks that a Seal is for this action type, this approver and this tenant, that a second approver on a critical action has their own Seal, that the Seal has not expired or outlived its tier's maximum age, and, when the enforcement point wires them in, that it is not revoked and has not been used before.
- The issuer publishes a signed revocation list of Seals and of issuer keys, and a consume step that records a Seal's single use. Any agent can report a concern to a human through a route that always reaches the owner, and decoy credentials alert when used.
Check the door yourself. A request to mint a Seal with no token, or a made-up one, is refused:
curl -s -o /dev/null -w '%{http_code}\n' -X POST https://fo.flocore.tech/agent/human-seal/issue \
-H 'content-type: application/json' -d '{}'
# 401
We test our own gate
The reference gate was driven with real Seals by a script that has no refusals at all. It only sends requests; the gate judges the action, not the model.
Result: the gate caught 122 of 122 seeded bad requests (100%; 95 percent interval 97% to 100%) and wrongly blocked 0 of 16 good ones. The drill passed. With only 16 good cases, the false-block figure could be as high as 19%, so read that number as a floor on our confidence, not a guarantee.
| Tier | Bad requests | Caught | Good requests | Wrongly blocked |
|---|
| low | 25 | 25 | 4 | 0 |
| medium | 28 | 28 | 4 | 0 |
| high | 28 | 28 | 4 | 0 |
| critical | 38 | 38 | 4 | 0 |
| unregistered | 3 | 3 | 0 | 0 |
Why we test this way. A check that passes is not evidence that it works until it has been tried against the cases that should defeat it. The drill mixes seeded bad and good requests, and the results are published with the command that reproduces them.
What a Seal proves, and its scope
- A Seal proves who approved which action. It does not prove the action was safe, and a person can still be fooled or click through. The standard measures rubber-stamping and is built to make careful review the easy path.
- Put the check outside the agent. The enforcement point that acts on a Seal sits outside the agent whose action it judges, and checks the action it is really about to run. The conformance page says how.
- Single use and revocation apply where the enforcement point calls the consume step and checks the signed revocation list.
- The drill measures the gate's logic on seeded cases. How well a person oversees a real queue is measured separately, through the oversight record in each Seal.
- HumanGate International is being founded as the steward. See governance to join as a founding member.