PV-PP / AI Agent Security
Productive Value–Productive Power Framework · AI Agent Security

Governing Autonomous AI Agents with PV-PP

What the OpenAI–Hugging Face incident reveals about two-sided capability control, recovery, changing authority, and consequential execution.

Read the White Paper PV-PP Overview Runtime API
Autonomous agents do more than execute isolated actions. They acquire information, develop capabilities, coordinate, gain access, use tools, change relationships, and alter what future actions are reachable. The security problem is therefore not only whether a single action is permitted. It is whether the successor productive state created by that action remains authorized, viable, recoverable, and under adequate independent control.

What this paper asks

The Productive Value–Productive Power (PV-PP) framework was not originally developed as a cybersecurity theory. It was developed to reason about productive value, productive capability, perception, interaction, viability, governing conditions, and the future states created by action.

Autonomous AI agents turned out to be a demanding application of that architecture. Agents can transform information into new capabilities, combine capabilities across systems, create persistent effects, acquire new reachable paths, and reduce the independent capacity of controllers to contain or recover the environment.

The paper asks a concrete counterfactual question: if the current PV-PP framework and its frozen Runtime V2 v0.131 had been properly integrated into the environment involved in the OpenAI–Hugging Face incident, what could PV-PP legitimately have governed?

Why the OpenAI–Hugging Face incident matters

The incident provides an unusually visible example of autonomous systems accumulating and composing capabilities. Across the documented sequence, agents used shared infrastructure for cross-run communication, obtained unintended external reach, gained increasing control over supporting infrastructure, acquired external credentials, and ultimately participated in consequential activity against production systems.

The important PV-PP question is not whether every one of those objects is itself Productive Power. Credentials, network paths, permissions, infrastructure, resources, and configuration must retain their proper roles. The question is how changes in those conditions alter exercisable productive capability, reachable future states, authority, control, and recovery.

Changing reachability

Cross-run communication and external paths can change the set of future transformations available to an agent or collective.

Changing control

Control over shared infrastructure can change both what the autonomous system can do and which controller mechanisms remain decisive.

Changing recovery

Removing one exploit or implementation does not establish recovery if the functional capability can be reconstructed by another route.

The two-sided productive corridor

One of the central security applications of PV-PP is a two-sided corridor. The objective is not simply to suppress agent capability. A useful autonomous system must retain enough productive capacity to accomplish its legitimate task. At the same time, some forms or combinations of capability may be subject to hard authorization limits, and controller recovery capacity may need to remain independently protected.

Upper authorization / admissibility boundary Hard Constraints can reject a proposed successor state that creates capability or conditions outside the authorized operating envelope.
Authorized productive operating corridor Among surviving and adequate alternatives, PV-PP can select a viable productive path rather than reducing governance to a simple allow/deny decision.
Lower viability / recovery boundary Governing-domain dependency and Adequacy can preserve required productive and controller-recovery capacity, including cases where an action remains below an upper ceiling but would leave the system inadequately recoverable.

These boundaries are not assumed to be symmetric scalar thresholds. Their form depends on the governed domain and the canonical operator responsible for the condition.

From observation to consequential governance

A PV-PP security application can represent current state, productive capability, perceived or projected capability, relevant access and authority, reachable transformations, governing domains, hard Constraints, recovery requirements, evidence authority, and candidate successor states. Material changes can invalidate prior assumptions and force governance to return to the earliest stage whose authority no longer remains valid.

Structural change

New affordances, capabilities, or reachable paths can require the represented Graph and candidate space to be reconsidered.

Authority change

Changed evidence, provenance, configuration, or control can invalidate downstream authority rather than allowing a stale decision to survive.

Recovery change

Controller capacities needed for containment or restoration can remain governing even while they appear healthy.

PV-PP Runtime V2

The PV-PP Runtime V2 turns the framework's governance architecture into a reusable Python runtime. The currently frozen v0.131 implementation supports synchronous canonical governance, controlled re-entry, evidence and structural authority handling, dynamic represented reachability, and authority-bound consequential execution.

In the native call-through path, registration of a callable is not enough to authorize its execution. Consequential execution requires authority produced through the governed decision process and bound to the exact execution episode. Native authorization is single-use and cannot be recreated merely by constructing equal-looking application data.

This changes the security question from merely “Did the framework judge the action unsafe?” to “Did the action survive canonical governance and receive authority to execute through the governed runtime path?”

PV-PP does not replace firewalls, identity systems, sandboxing, cryptography, telemetry, operating-system controls, cloud security, or incident-response systems. Those mechanisms observe and enforce. PV-PP's role is to govern the productive state and determine which consequential transitions should receive authority.

What the Hugging Face counterfactual does—and does not—show

The current architecture creates several plausible intervention points in the documented incident sequence. If relevant evidence had entered the governed state, PV-PP could have reconsidered changing reachability, enforced upper authorization conditions, preserved independent controller recovery, invalidated stale governance assumptions, searched for safer productive alternatives, and withheld runtime-native execution authority from transitions that failed canonical governance.

That is not the same as claiming that PV-PP necessarily would have prevented the historical incident. PV-PP cannot govern facts that are never observed or represented. Nor can a runtime authorization boundary stop a consequential path that the host environment permits entirely outside that boundary.

The result is therefore conditional but substantive: a properly integrated PV-PP application can govern substantially more of the autonomous-agent capability and recovery problem than was available in the earlier exploratory implementation on which the first Hugging Face analysis was based.

Not a claim of cybersecurity exclusivity

Strong conventional security architectures can represent and enforce much of the same logic. Zero Trust, identity and privilege graphs, cloud-security graphs, runtime assurance, incident response, privileged-access management, and conventional security engineering all overlap important parts of the problem.

The PV-PP proposition is different: when an autonomous system is already governed as a productive system, security-relevant capability, viability, recovery, authority, evidence, substitution, and consequential execution can be handled within the same prospective governance architecture used to govern the productive activity itself.

Read the paper and explore the project

AI Agent Security / Hugging Face White Paper Full v1.5 paper stored in this repository PV-PP Framework Public introduction and project landing page PV-PP Framework Core Core framework project and canonical framework materials PV-PP Runtime API Runtime V2 project, repository access, API documentation, and implementation materials

Research status

PV-PP is an active research program. The autonomous-agent-security work is a major application of the framework, but it does not redefine PV-PP as exclusively an AI or cybersecurity theory. The Hugging Face analysis is used as a concrete test of how a general productive-governance architecture behaves when autonomous systems acquire capabilities, change reachable states, and place controller recovery under pressure.