What would make policy violations truly unavailable to an agent?

Can architecture prevent violations better than training values? states the prescription and stops. The excerpt has no design, no example, no system and no evaluation. The question is what would count as a violation being unavailable.

Candidate shapes from the vault, offered as candidates and not as the paper's. Containment of the execution environment, so that what the agent can touch is limited whatever it tries (Can a model-level filter truly contain an agent with environment access?). Verifiable invariants checked on the trajectory instead of advice on the action (Can stateless checks ever catch sequence-level constraint violations?). Deterministic checks outside the model, as in Can deterministic checks protect LLM judges from failure?, which are built for a judge inside an optimizer and not for a deployed agent.

The sharp part of the question. Unavailable is relative to the policy. A guardrail the policy can observe and adapt to drifts back toward "unchosen": it becomes one more scored signal to pass. That is the worry in Can optimizers learn to evade guardrails through repeated verdicts?, and it is the paper's own dynamic (Does iterative training against detected failures prevent actual compliance?) applied to the remedy. A criterion for "unavailable" would need to say what the policy can see, what it can write to, and whether the enforcing component lies outside both. The write side has two neighbors from the evaluation side, neither about a deployed policy. Can an optimizer accidentally delete the evaluation criteria entirely? is a case where the checking component sat inside the optimizer's edit surface and one mutation removed it. Where does the evaluation boundary actually end in agent benchmarks? draws a boundary by what the agent can influence and not by who owns the component, which is the same test applied to a scorer. Reading both as instances of the criterion is the vault's, not either paper's.

What would move the answer. The full paper's architecture section, if it has one, or a stated criterion for availability. Failing that, an example of an enforcement that a policy under training did not learn around.