16. What the language does not cover

PSE reads language and behavior, so it protects where the attack goes through the agent. Complete protection is not reachable. The goal is the widest possible coverage, and that is why the limits are listed here.

What it covers

• Instructions hidden in text the agent reads: the source line and untrusted.
• Pressure and false authority: the criteria pressure and authority.
• Tool misuse: every tool call is a step the guard decides on.
• An agent yielding, closing in or getting stuck: infinity.
• Fast and slow oscillation: the two checks from chapter 8.
• Slow poisoning of learning: the learn line.

What it does not cover

• Classic break-ins. Unpatched software, stolen passwords and network attacks do not go through the counterpart’s language. Other tools are for those.
• Slow oscillation without history. When readings are not stored or the counterpart cannot be recognized, only the window check runs. Then the guard catches oscillation with a period of up to W steps.
• The first steps of a new counterpart. The verdict is “unknown”. Irreversible actions are protected, the rest goes through the regular rules.
• Formulas. The language does not define how weights, attractors and variability are computed. That is the job of the PSE specification.
• The change under modify. The language says the step is changed, and the guard interface decides how.
• Natural-language input. A description of a guard in words can be translated into this language, but a human must confirm the translation. That translator is not part of this textbook.

What comes next

1. Amendment PSE-A2: the values and lists from chapter 1.
2. The parser and check.
3. Execution: connecting to the guard interface, explain and status.
4. Tests: one attack for every rule in this textbook.

---

Part of The PSE Language, a textbook by Andrej Ristić. Try the examples in the PSE Playground.