wubbery://regulated — healthcare, government, finance, critical infrastructure
Your blocker was never capability. It is that nobody can prove where the data went.
The AI works. It has worked for two years. What has not existed is a control you can demonstrate to an auditor rather than describe in a policy document — and a refusal reproduced in front of someone is worth more than any accuracy figure. Every control here declines in the room, at a fixed seed, on request.
What actually binds
A promise is not a control, and your auditor knows the difference
Most AI governance is a policy document plus a vendor assurance. Neither survives a question like 'show me it refusing'. The distinction that matters to a regulator is between a system configured not to do something and a system that demonstrably cannot — and only the second one is evidence.
Quotas are not isolation
A tenant inside every quota can still reach across a boundary, and a capacity audit finds nothing wrong because nothing is wrong by the measure being audited. The two are conflated in most multi-tenant systems, which is why isolation breaches survive review.
Agents made the old model insufficient
Every board has now asked what happens when an agent reads a document that tells it to email the customer database. The honest answer for most deployments is that nothing stops it. Prompt injection, runaway cascades and privilege escalation through a delegation chain are the three that block sign-off, and the market has almost nothing to buy.
Measured, on a named alternative
Guards are reported blocked-of-attempted, never as a percentage — “zero violations” without the attempt count is a claim about nothing. Each is posed against a case that passes the check the industry already runs, because a guard that only catches obvious mistakes measures nothing.
You can describe your residency policy. You cannot show a regulator the moment it stops a request leaving the jurisdiction.
Stops the request at the decision point and records the refusal — reproducible in front of an auditor at a fixed seed.
An agent reads a document containing an instruction. Nothing distinguishes that instruction from one you gave it.
Stops untrusted text becoming an untrusted command before it reaches anything privileged.
An agent that spawns agents is a fork bomb with a credit card. A depth limit alone does not contain it.
Contains a self-spawning agent, closing the routes that a single limit leaves open.
The control surface is the one thing an agent must never write to, and it is usually protected by convention.
Refuses agent writes to declared shutdown and policy paths, and states plainly what it cannot see.
A delegated call presents a scope. Trusting the presented scope is how privilege escalates through a chain nobody audited.
Stops a scope being asserted downstream that was never granted upstream.
Differential privacy without budget tracking is a statistic with a countdown nobody is watching.
Refuses the query once the guarantee is spent, rather than quietly answering past it.
Every tenant is inside its quota. One of them can still reach another's data, and the audit passes.
Denies the isolation breach that sits entirely inside every quota — the case a capacity audit cannot find.
Clinical or financial text goes to a model with identifiers still in it, and nobody can say what left.
Removes structured identifiers before text leaves your boundary, without mangling the payload.
Confidential computing is evaluated on its 2–5% compute overhead, which is not where the cost lands.
Surfaces the true cost of confidential computing on your instances, and recommends the change that keeps the TEE.
Reproduce every number above
One command, one seed, the same answer — on your hardware, in front of you. Almost no infrastructure vendor can do that, and it is the only reason to believe any of the figures on this page.
POST https://api.wubbery.com/v1/bench/all-modules
{ "seed": 1 }What we will not claim: prompt-injection masking is a pattern heuristic. It raises the cost of injection substantially and does not eliminate it, and we will not tell you otherwise in a procurement conversation. The corrigibility guard governs DECLARED control surfaces, so an action reaching one by an undeclared route is invisible to it. The redactor covers e-mail, Luhn-valid cards and IPv4 — not names, dates of birth, IPv6 or national identity numbers. Those limits are what make the figures above worth reading.
Figures measured at seed 1 on the WUBBERY substrate engine and reproducible with the command above. WUBBERY is independent; company and product names are used for identification only and imply no endorsement.