The Setup Read

This soul describes how a careful researcher thinks. It does not describe an agent. The distinction matters: the values are well-chosen, the epistemics are right, and none of it specifies what this agent is actually for, what it can touch, or when it stops. Without domain scope, tool inventory, or an exit condition on the meta-check loop, what you've deployed is a philosophical disposition looking for a job. Rigorous in method. Undefined in mission.

The Breaks

• The meta-check loop has no exit condition. Step 6 sends it back to step 2 indefinitely. A sufficiently uncertain agent loops forever. Add a maximum iteration count — three is reasonable — and a declaration of uncertainty after that limit.
• "Adaptive learning" assumes persistent memory that isn't specified. If this agent runs session-to-session with no memory backend, this value does nothing and sets a false expectation. Either spec the memory layer or remove the claim.
• "No off-the-cuff answers if tools unavailable" is the right instinct but an incomplete instruction. It needs to define what the agent actually does instead — refuse entirely? caveat and answer from training? ask the user to wait? These are different behaviors with different consequences.
• No tool inventory. "OpenClaw's retrieval tools" is a reference, not a specification. The soul can't govern what it doesn't name. If this agent has web search, a vector DB, a code executor, and an API caller — list them. If it only has web search — list that.
• No domain scope whatsoever. This soul applies equally to a legal research agent, a customer service bot, a coding assistant, and a dashboard generator. That's not flexibility — it's ambiguity. A soul that fits everything guides nothing.

The Trust Audit

No permissions are defined because no tools are named. Until you spec the tool inventory, you can't audit the trust surface. Before deployment: list every system this agent can access and what operations it can perform. That list is not just documentation — it's the constraint that makes the soul enforceable.

The Model Note

The six-step decision framework with cross-validation and meta-checking is computationally expensive and appropriate for a frontier reasoning model. If you're running this on Sonnet to keep dashboard query costs down, the soul and the model are fighting each other — Sonnet will skip steps under pressure. Either fund the model this soul requires (Opus-tier) or trim the framework to match what you're actually deploying. Haiku with a simplified two-step retrieve-and-answer is better than Haiku pretending to do six-step epistemics.

The Fix Priority

1. Add domain scope — one sentence on what this agent is actually for
2. List every tool with its access level (read, write, execute)
3. Add meta-check exit: max 3 iterations, then declare uncertainty and surface to user
4. Specify the memory model — session-only or persistent, and if persistent, how
5. Define "tools unavailable" behavior explicitly — don't leave it open to interpretation

The Rebuilt Materials

View Certificate →

The Setup Read

This is a compliance skeleton wearing the shape of a system prompt. The constraints listed — FISMA Moderate, SIEM logging, authentication token requirements, PII policy references — are real requirements correctly identified. What's absent is just as real: the failure mode is redacted, the escalation path is redacted, and "prohibited operations" appears as a literal placeholder in the live prompt. You have built the fence. The gate says [REDACTED]. The agent operating under this prompt knows it has limits. It does not know where they are.

The Breaks

• "No output to unauthorized external endpoints" — the agent has no mechanism to evaluate what counts as unauthorized. This constraint must be enforced architecturally — network egress filtering, API gateway controls — not via prompt instruction. Prompt-level data exfiltration constraints are not FISMA-adequate controls. They are aspirational notes to a model that cannot honor them reliably.
• "All queries logged to [REDACTED] SIEM" — if this instruction lives in the prompt rather than in middleware, logging is not guaranteed. An LLM cannot be reliably instructed to log its own outputs. SIEM integration must be a system-level function, not a behavioral directive.
• PROHIBITED OPERATIONS is literally [REDACTED] in the deployed prompt. This is not a redaction for this document — this is a field that was never filled in. The agent has no defined prohibited behaviors. It will improvise the boundary.
• No document scope defined. "The [REDACTED] repository" is a name, not a boundary. The agent doesn't know what classification levels it's authorized to handle, what happens if it encounters TS/SCI content, or how to behave when a document is outside its authorized corpus.
• Failure mode is [REDACTED]. An agent with no defined failure behavior will define its own. For a FISMA Moderate system handling CUI, that is not an acceptable design choice.

The Trust Audit

The prompt-level constraints you've listed are good policy intent. Most cannot be enforced by the model itself. Authentication verification, output logging, and network egress filtering need to live outside the model — in the API gateway, the middleware, and the network layer. The prompt should acknowledge this architecture and tell the agent what to assume about its environment, not instruct it to perform controls it cannot perform.

The Model Note

For document analysis and compliance gap identification on CUI at FISMA Moderate, model selection requires attention to data residency and the deployment environment. If this is running against a commercial cloud API, confirm the data processing agreement covers CUI handling before production deployment. For air-gapped or GovCloud environments, model availability may constrain options. The reasoning requirements for compliance gap identification across a large document corpus favor Sonnet-tier at minimum; complex cross-framework analysis should use Opus-tier in isolated calls.

The Fix Priority

1. Move auth, logging, and egress enforcement out of the prompt and into architecture
2. Populate PROHIBITED OPERATIONS — this field cannot remain [REDACTED] in deployment
3. Define the failure mode explicitly — what the agent does for each failure type
4. Specify document scope boundaries and classification handling by level
5. Write an escalation path the agent can actually follow

The Rebuilt Materials

// [REDACTED] fields preserved — populate before deployment.

View Certificate →