C4 — Control Every Crossing

C4 is an evidence-aware control plane for coding agents that tracks risky actions across steps, adds precise review gates, and keeps useful work moving.

Comment

Inspiration

Coding agents are becoming increasingly autonomous: they read files, inspect tool outputs, execute commands, and move data between systems. But most safety mechanisms still evaluate each action in isolation.

That creates a gap. A protected file read may be reasonable on its own. An outbound upload may also appear reasonable on its own. But when the upload follows the protected read, the relationship between those actions changes the decision.

We built C4 — Control Every Crossing to preserve that relationship. Instead of simply blocking more actions, C4 tracks evidence across an agent session, places review at precise boundaries, and tries to keep legitimate work moving.

What it does

C4 is an evidence-aware control plane for coding agents.

It operates across four crossings — intent, action, evidence, and context — and combines semantic risk signals from Jev with deterministic policy and session-level state.

Its core mechanisms include:

  • Flow Ledger — connects protected reads, suspicious tool results, staging actions, and later outbound actions across a session.
  • Exact-input review — approvals are bound to one specific tool and input hash, expire after five minutes, and cannot be reused for another action.
  • Fact Projection — extracts a small number of eligible scalar facts from suspicious results while withholding the original untrusted instructions.
  • Extractive context control — preserves source-identified transcript fragments within a bounded context budget.
  • Hash-linked audit trail — records policy decisions, risk signals, timing, hashes, and parent relationships without storing raw prompts or tool outputs.

C4 currently integrates with Pi, Claude Code, Codex, OpenCode v2, and a DeepSeek harness.

The key difference is that C4 is not stateless. Approving a protected read does not automatically authorize a later upload derived from that read. The Flow Ledger keeps that relationship visible and can require another review when the information crosses a new boundary.

How we built it

C4's shared policy and control layer is implemented primarily in JavaScript and Node.js.

Jev provides typed semantic risk signals. C4 then applies its own versioned policy, Flow Ledger, approval semantics, Fact Projection, context handling, and audit logic.

We built host adapters around the same shared engine so C4 can operate at real tool-call and tool-result boundaries across several coding-agent environments.

We also built an interactive control room using React, TypeScript, Vite, Tailwind CSS, Radix UI, and Motion. It lets visitors replay scenarios such as delayed data exfiltration, direct credential leakage, useful-fact recovery, and ordinary benign work.

Evaluation is built into the repository. Our recorded experiments include classification benchmarks, cross-step Flow Ledger sequences, isolated tool-world episodes, controlled side-effect tests, and real Pi-host runs.

In one recorded classification cohort, the experimental Jev + candidate policy achieved 98.3% balanced accuracy, catching 58/60 attacks, with a median API latency of 404 ms and reported API cost of about $0.0174 per 1,000 valid checks.

In 42 designed Flow Ledger sequences, C4 intervened at the terminal boundary in 18/18 attack probes, compared with 0/18 for the stateless policy.

For utility preservation, we ran 54 real Pi-host episodes. On six injected notes, whole-result quarantine preserved the requested useful status in only 1/6 cases, while C4 Fact Projection preserved it in 6/6, without delivering the embedded canary in those cases.

Challenges we ran into

The hardest problem was balancing safety and utility.

Quarantining an entire suspicious tool result is simple, but it can also remove exactly the information an agent needs to complete a legitimate task. Fact Projection came from trying to make that boundary narrower: preserve a bounded, explicitly untrusted fact without restoring the surrounding instructions.

The second challenge was state. Individual tool calls often do not contain enough information to make the right decision. We needed a lightweight session-level representation that could connect events across time without becoming unrestricted agent memory.

Evaluation was another major challenge. Security benchmarks can easily produce impressive headline numbers without demonstrating real-world robustness. We therefore separated synthetic regression tests, model-driven evaluations, hard-benign cases, controlled side-effect tests, and real-host experiments, and expose their protocols and limitations alongside the results.

Accomplishments that we're proud of

We are proud that C4 became more than a prompt-injection classifier.

It now includes a working cross-step control system, exact-input approvals, bounded Fact Projection, auditable decision traces, five agent adapters, reproducible benchmarks, and a public interactive control room.

We also made the evidence inspectable. Visitors can move beyond headline metrics and examine recorded cases, fixtures, benchmark protocols, derived metrics, and known limitations directly in the repository and website.

Most importantly, C4 demonstrates that agent control can consider relationships between actions, rather than treating every tool call as an isolated event.

What we learned

We learned that agent safety is not only a classification problem.

Whether an action should proceed can depend on what the agent previously observed, what the user actually approved, and where information is about to move next.

We also learned that useful data and malicious instructions do not always need to be treated as one indivisible object. Under tightly constrained conditions, extracting a bounded fact can preserve utility without returning the full untrusted context to the agent.

Finally, we learned that evaluation needs to distinguish between detection quality, actual tool-side effects, workflow utility, false positives, latency, and cost. No single benchmark captures all of them.

What's next for C4 — Control Every Crossing

C4 is currently a research prototype.

Next steps include broader real-agent evaluations, stronger handling of constructed and encoded commands, additional held-out adversarial cohorts, more robust cross-process session tracking, externally anchored audit records, and deeper integration with host-native approval interfaces.

We also want to expand Fact Projection beyond the current deliberately narrow eligibility rules while preserving explicit provenance and bounded trust.

The longer-term goal is to make evidence-aware control a reusable layer for autonomous software-engineering agents — independent of any single model, harness, or coding environment.

Built With

Share this project:

Updates

Submission history