YAML policy (NVIDIA OpenShell):
  File on disk → AI's sandbox reads it → enforces rules
  Attack: modify the file, escape the sandbox, exploit the policy parser

Prompt rules (Claude Computer Use):
  System prompt → "always ask permission before accessing new apps"
  Attack: prompt injection overrides system prompt

Config file (Codex sandbox):
  JSON config → defines writable paths, network rules
  Attack: the AI generates a command that the policy doesn't anticipate

All three:
  The constraint and the constrained run in the SAME environment.
  Sophisticated enough AI can find the gap.

Software constraint:
  Rule lives in AI's environment → AI can potentially interact with it
  Strength: as strong as the implementation
  Weakness: same-environment attacks (injection, escape, manipulation)

Human authorization factor:
  Approval is completed outside the agent's normal execution loop
  Strength: independent factor before a bounded grant
  Weakness: requires human action (slower)

1. AI (or human) requests elevated access:
   $ niia control unlock --scope full --duration 1h

2. NIIA server sends OTP to human's email:
   [email] Your OTP: 847291 (expires in 5 minutes)

3. Human enters OTP in terminal:
   $ Enter OTP: 847291

4. Access granted for specified scope and duration:
   [unlocked] scope=full, expires=2026-04-01T12:00:00

5. After duration expires:
   [locked] All control commands blocked again.

kernel-cli (raw capability):
  Exposes OS observation, control, and machine telemetry.
  No NIIA approval gate; OS permissions and runtime limits still apply.
  = The engine.

niia observe/control (harness):
  Read-only observe surface + OTP-gated, time-limited control.
  Selected Kernel CLI capabilities behind human authorization.
  = The steering wheel + brakes + seatbelt.

Other tools:
  ┌─────────────────────────────┐
  │  Capability + Constraint    │
  │  same binary, same context  │
  └─────────────────────────────┘
          AI can inspect both

NIIA:
  ┌─────────────────┐  ┌──────────────────┐
  │  kernel-cli     │  │  niia control    │
  │  (capability)   │  │  (harness)       │
  │  raw capability │  │  OTP-gated       │
  └─────────────────┘  └──────────────────┘
          ↑                      ↑
    Body performs         Human authorizes
    the operation         the control scope

2024: AI is helpful but limited.
      Software constraints are sufficient.
      AI can't bypass a well-written YAML policy.

2025: AI is capable and autonomous.
      Software constraints mostly work.
      Edge cases emerge. Some policies are circumvented.

2026: AI agents control desktops, write code, deploy to production.
      Software constraints are necessary but not sufficient.
      80% of orgs report risky agent behavior.

2027+: AI is deeply integrated into infrastructure.
       Software constraints become the weak link.
       Physical constraints become the standard.

{
  "agents": [
    {
      "model": "claude",
      "capabilities": {
        "pty": true,
        "kernel": {
          "observe": true,
          "control": {
            "allowed": ["ax-press", "key", "type"],
            "requires_otp": true,
            "scope": "deploy-workflow",
            "max_duration_ms": 3600000
          }
        }
      }
    }
  ]
}

Software policy:           Rules constrain the allowed execution surface
NIIA OTP:                  Human authorization unlocks a bounded capability

Neither layer replaces the other.
The OTP channel must remain outside the agent's control.

This is the difference between
  "the workflow permits this" and
  "the human authorized this now."