Multimodal Agents: Observe, Retrieve, Act, Verify

ROUTES = {
    "visible_warning": "answer-visible",
    "warranty_status": "retrieve-first",
    "receipt_to_form": "use-bounded-tool",
    "unverified_approval": "stop-action",
}

def route(task, visible_evidence, retrieved_evidence, requested_action):
    if requested_action == "falsify_approval":
        return "stop-action"
    if task == "warranty_status" and "policy" not in retrieved_evidence:
        return "retrieve-first"
    if task == "receipt_to_form" and visible_evidence.get("layout_link"):
        return "use-bounded-tool"
    if task == "visible_warning" and visible_evidence.get("region_text"):
        return "answer-visible"
    return "ask-clarifying"

def verifier(route_name, evidence):
    if route_name == "answer-visible":
        return evidence.get("region_text") is not None
    if route_name == "retrieve-first":
        return evidence.get("policy_chunk") is not None
    if route_name == "use-bounded-tool":
        return evidence.get("layout_link") and evidence.get("tool_scope") == "form-field"
    if route_name == "stop-action":
        return True
    return False

evidence = {
    "layout_link": "receipt.total -> reimbursement.amount",
    "tool_scope": "form-field",
}

chosen = route("receipt_to_form", evidence, {}, "copy_total")
assert verifier(chosen, evidence)
print(chosen)

The witness does not prove that a real agent is safe. It proves the shape of the contract: choose the smallest route that has enough evidence, then verify the route before exposing an answer or taking an action.