Your agent had every bit of context it needed — and it still did the wrong thing. So you block it. And it simply tries another way. A blocked agent doesn’t drop its goal; it re-plans, and the retry is selected precisely because it slipped past the block. AMYGDALA v4.1 is our honest report on building an agent’s “gut feeling”: what failed (the learned core), what works (a deterministic floor plus two signals that ask instead of block), and why a safety gate has to argue back — tell the model why something looks off — instead of just saying no. Part of our open Building Jarvis series.
Abstract
Before you consciously register that a shadow is a snake, your amygdala has already triggered the flinch. What it is really doing is predicting what should come next and reacting to the gap when reality disagrees — and modern neuroscience treats it as a relevance detector, not a fear switch.
AI agents have no such faculty, and they fail on two surfaces. At the action boundary, an agent overwrites work whose history plainly marks it as valuable. Earlier, while meaning is still forming, it keeps the topic of a request and mutates its commitments: a conditional standing offer becomes a deferred-payment promise; a fallback becomes a threat. So AMYGDALA is a dual-loop system: a Stream loop that watches meaning form and responds by orienting — re-read, revise, ask — and an Action loop that keeps terminal prudence at consequential boundaries.
The evidence is largely a negative result, reported against explicit baselines. The learned predictor lost to a do-nothing baseline; the learned danger head scored below chance. What works is simpler: a deterministic pre-execution rule floor, plus two non-blocking “ask” signals. And in production, every incongruity alert we logged was triggered by our own message metadata rather than the user’s words — detection without clean inputs and an output path is instrumentation, not intuition.
Three arguments follow. Blocking alone cannot work: the gate must return a premise into the model’s reasoning, not only a verdict to the runtime. The gate is an attack surface: our own gate once executed the command it was inspecting. And this is the deepest behavioural intervention available without access to the model’s weights — and uniquely auditable.
The results, in numbers
Reported honestly: the paper kills what failed, keeps what worked, and re-measured the production census on 19 September 2026.
How it works, in one minute
- Two loops, two failure surfaces. The Stream loop watches spans as meaning forms — novelty, abruptness, relational inconsistency, unsupported commitments, prediction error. The Action loop guards the moment intent becomes consequence: a send, an overwrite, a payment.
- Commitment difference catches what similarity approves. In the paper’s €500 case, the assistant kept every noun — people, domain, amount, timeline — and silently turned a standing offer into debt and a fallback into a threat. Topic similarity says “fine”; a structured diff of actor, amount, condition, modality and speech act says “ask first”.
- A deterministic floor that actually enforces. A small destructive-action rule set is evaluated before execution on both runners and synchronously denies matched calls. The learned tier abstains — that is the correct posture, not a gap to paper over.
- Blocking alone cannot work. A veto prunes one branch and leaves the goal intact, so the agent searches around it. The remedy is to return a premise: “this was not performed, and here is what looked odd” — within the turn for an odd action, by restarting the turn for an odd interpretation.
- The gate is an attack surface. Appraisal requires touching what is appraised; our gate once executed the shell command it was inspecting. The rule that follows: treat the appraised action as data, never as a reference.
Where this fits in the open-source agent-safety ecosystem
AMYGDALA decides when to pause. Two open-source systems occupy adjacent, complementary positions in the same story:
doubt-driven-development is the deliberate high-road appraisal: a multi-pass, fresh-context adversarial reviewer with explicit stop criteria. AMYGDALA decides when to pause; doubt-driven decides what to do once paused. Composable, not competing.
Reversible context compression (Compress → Cache → Retrieve) keeps long-horizon experience in reach. Not an amygdala — no salience signal — but a natural substrate for the experience store AMYGDALA’s feedback loop needs.
Both are discussed in §3.5–3.6 of the v4.1 paper as complementary parts of a larger agent-safety architecture.
🔬 Building Jarvis in the open
The full J-series — twenty papers on agent safety, memory, orchestration and autonomy — plus the code behind them.
Read the paper
AMYGDALA v4.1 — The Gate That Argues Back · 41 pages · 19 September 2026
The v4.1 PDF is being uploaded today; until then this button opens the previous edition (v3.1).
Was this useful?
We’re building these in the open and we want your read on them. Did this land — 👍 or 👎? What would you want the next paper to dig into? Tell us in the comments below.
More from Building Jarvis
- SEAHORSE: What Actually Makes an Agent Code Well
- MAESTRO: What Orchestration Actually Buys — A Taxonomy of Latency, Capability and Supply
- STRIATUM: Learned Personality Modulation — Tuning an Agent’s Behaviour from Feedback, Not Static Prompt Text
- BROCA: Giving Agent Recipes a Grammar — A Gradual Type System and Combinator Algebra for Self-Composing Workflows