Control without detection.
“You cannot monitor your way into legitimacy. You cannot log your way into provenance. You cannot alert your way into identity.”
— the roadmap's own argument, turned on its method
DeepMind has written the most careful plan in existence for catching a misaligned AI agent before it does harm. Read it closely and a strange thing happens: the document talks itself, tier by tier, to the edge of its own method — and then names the cliff. Its top detection tier, D4, is the capability range where the agents you most need to watch can no longer be watched by anything you trust. The roadmap is honest about this. It is the strongest argument we have seen — written by the people least incentivised to write it — that detection is the wrong thing to make load-bearing.
This page takes the roadmap seriously, agrees with almost all of its premise, and then makes one move: it asks what changes if you stop trying to detect the lie and start constraining the action.
“DeepMind's roadmap tells you to detect the misaligned agent. The agent only has to win once. KTP tells you the agent can't act faster than the environment can hold — so you don't have to win the detection race to be safe.”
Mary Phuong, Erik Jenner, Laurent Simon, Lewis Ho, Rohin Shah, Sebastian Farquhar, Scott Coull (16 June 2026). GDM AI Control Roadmap v0.1. Google DeepMind.
A second line of defence: assume alignment fails, treat capable agents as untrusted, and contain the harm with a security mindset borrowed from insider-threat practice.
A second line of defence. Assume alignment fails; treat capable agents as untrusted; contain the harm with a security mindset borrowed from insider-threat practice — zero-trust, least-privilege, defence-in-depth. Two control invariants carry the plan: detection (misaligned intent or actions would be caught) and prevention and response (given detection, no severe harm). A threat taxonomy — TRAIT&R, built on MITRE ATT&CK — names what the adversary might do. Two capability–mitigation ladders, Detection D1→D4 and Prevention/Response R1→R3, escalate the defence as models grow more capable. Fifteen concrete mitigations run from chain-of-thought monitoring to separate agent identities to shutdown infrastructure.
It is excellent, and most of it is right. The disagreement that follows is narrow, and it is the roadmap's own document that opens it.
Before the disagreement, the agreement — because the agreement is the surprising part. A frontier safety lab, working from security engineering with no knowledge of KTP, rebuilt KTP's premise line for line:
The capability–mitigation ladder is A≤E reinvented without being named as a law — the same move Anthropic's "impossible, not tedious" design test makes. One honest caveat, kept from the graph: GDM and KTP share AI-control ancestry, so this is a sibling-lane convergence, not a fully independent one. It still counts. The bound keeps getting rediscovered.
The roadmap's detection ladder is a staircase down into a basement. Each tier the model gets more capable, the monitor gets weaker — until the last one, where the roadmap stops being able to promise the guarantee at all.
“Monitoring is the backbone of AI control.”— Google DeepMind, “Securing internal systems against increasingly capable and imperfectly aligned AI,” 18 June 2026
That is the announcement's own section heading — detection named as the load-bearing element, in their words, not ours. The ladder below is what happens to a backbone under load. And DeepMind reports it from a live deployment: the Gemini Spark monitor, tuned on a million coding-agent tasks, found that the majority of flagged events were not adversarial at all. The backbone carries noise before it ever carries an attack.
The chain-of-thought is legible; the model is not gaming oversight.
Read the chain-of-thought.
The model is oversight-aware and tries to game the monitor.
Harden the monitor; suppress evaluation-awareness.
The chain-of-thought goes dark — opaque or steganographic.
Fall back to a trusted model watching behaviour.
The capability gap is wide enough that no trusted model can tell the untrusted model's attacks apart from benign work.
Untrusted models monitoring untrusted models, and activation probes the roadmap itself concedes are unproven and collusion-prone.
“D4 is the strongest argument for KTP that DeepMind could have written.”
This is not our critique of the roadmap. It is the roadmap's account of itself. Detection is a race, and the document tells you the year the defender loses.
Here is the single structural difference, and it is in the roadmap's own wiring. Its prevention invariant is conditioned on its detection invariant — "assuming effective detection, the model cannot cause severe harm." Synchronous response requires synchronous monitoring to catch the action first. So when detection fails at D4, prevention's guarantee fails with it.
KTP inverts the dependency. A≤E gates the action on the state of the environment, not on whether you can read the agent's intent. A high-blast-radius action does not proceed when the environment cannot hold it — liar or not, detected or not. You do not have to win the epistemic race to be safe, because safety was never staked on the race.
Three primitives the roadmap lacks entirely. They are why KTP is not a relabel of the prevention track but a reordering of it — prevention made primary and detection-independent — plus the pieces containment never had.
A trust-accrual ladder
where the roadmap's "trusted" means "too weak to be dangerous"Trust is granted by incapacity, not earned by conduct — so there is no path from untrusted to trusted, and the binary collapses as capability rises (eventually nothing qualifies). KTP earns trust by trajectory: Tethered → Divergent → Persistent.
Costly sponsorship
where the roadmap has no answer to multi-party collusionThousands of instances can collude, and containment has no structural reply. A sponsor who stakes their own standing — and is debited when the sponsored agent defects — is one. Vouching that costs nothing is a fog-priced signal; vouching that costs the sponsor is load-bearing.
A constitutional veto (Soul)
where blocking and shutdown are reactive, gated on detectionEvery action the roadmap stops, it stops because a monitor caught it. KTP carries a detection-independent line no score and no missed alert can cross — the action does not resolve at the substrate, whatever the agent decides to attempt.
KTP does not escape epistemics; it relocates them.
Instead of "read the agent's hidden intent" — the race GDM loses — KTP must "measure the environment's stability and the action's blast radius." That is also hard, and an agent that can poison the measurement of the environment pushes the problem back one level. KTP's bet is that environment-state is more observable and less gameable than a mind's hidden intent. That bet is plausible and load-bearing, not free. We state it so the reader can test it.
The roadmap and KTP are not rivals. The roadmap is the most rigorous map of governance-by-containment, drawn honestly enough to mark where containment dies. KTP is the invariant that lets you stop walking toward that cliff: make prevention primary and detection-independent, and the D4 basement stops being the place your safety goes to fail.
For KTP located against the field's full coordinate system — ATT&CK, D3FEND, CSF 2.0, SP 800-207, ATLAS, OWASP LLM Top 10, AI RMF — see the Defense Map. This page is one concrete instance of that map: where a frontier lab's containment roadmap sits, and what the authorization layer adds beneath it.
And where the roadmap reads the problem as a security-engineering one, Magnifica Humanitas reads the same substrate question constitutionally. Same missing layer, named at adjacent altitudes.
- documentthe roadmap, read and onboarded to the research graph
- claimthe capability–mitigation ladder is an unnamed A≤E instance
- claimprevention gated on detection vs detection-independent authorization
- claimthe trusted/untrusted binary collapses; trajectory + sponsorship + Soul are missing
- steelman"KTP is a relabel of the prevention track" — stated and rebutted