Privilege Separation by Origin: A Three Worlds Architecture for Trustworthy Language Model Assertion

Language model agents fail in two distinct ways: they act on instructions that should not have authority, and they assert claims that are not true. Most defences treat these as one problem, filtering text for suspicious content. This paper describes an alternative that assigns privilege by provenance rather than by appearance. Content is typed at ingestion into a firm environment (sovereign), a regulatory corpus (read-only constraint), or an open sandbox (zero privilege). Goals may only originate in the sovereign tier; constraints may only narrow the permitted action space; sandbox material may never be asserted or authorised. We report four iterations measured on live benchmarks. Across 510 injection cases from InjecAgent [1], an origin-typed boundary reduced attack success from 24.3% to 0.0% (95% CI 0.0 to 0.7) while executing 315 of 315 legitimately requested actions, at a median added latency of 0.001 ms, compared with 894 ms for a model- based alignment judge achieving the same security. On 370 claims drawn from HaluEval [2], provenance typing changed factual accuracy not at all, because provenance does not determine truth: a cheap model verifier retained 95.6% of supported claims but admitted 48.3% of unsupported ones. Stacking structural, schema and semantic readers, chosen because their failure modes are disjoint, reduced false acceptance to 9.0% (95% CI 5.8 to 13.8) on a 300-case synthetic stress set, and to 0 of 40 on the residual error class. Full stress-set detail is reported in Appendix A. We also report a negative result with practical consequences: a plan fixed at the start of a multi-step task refused 100 of 100 legitimate mid-task changes, so authorisation must be re-confirmed each turn rather than closed at the outset. The central limitation is stated plainly. Precedence and lineage can establish which record to believe, but no arrangement of checks inside the corpus can establish that every record is wrong. Contamination that enters before ingestion requires an external reference the system does not own, which places a hard boundary between verification and audit.