Concepts

Intent is not authority

Model: proposed intent
  |
  v
INTERPLANE: normalized requests, provenance, policy decisions
  | eligible request or refusal
  v
Runtime: capabilities, approval, execution, results

The protocol describes the boundary; it does not give a model permission to act. Runtime-owned capabilities, policy and human approval decide which effects may execute. Untrusted retrieved text is content, never an instruction with runtime authority.

Trace each decision

Follow a model-native proposal through normalization, source labels, a policy decision and the runtime result. Rejected or ambiguous inputs must remain visible as refusals; do not silently repair them into authority.

Canonical sources: Core, Crossveil and Lenshift. The offline exercise makes this boundary observable.